Add key compromise analysis section for top-level roles.

[lukpueh]

I suggest to add a simple key compromise analysis section for the top-level roles akin to the corresponding sections in PEP 458 and PEP 480. That is a matrix that shows what type of keys an attacker needs to compromise in order to successfully perform a given attack.

The 2.2. Threat model and analysis should be a good place for this.