Add security consideration section (#221)

* WIP: Add security conscideration section

This is required in an IETF standard, we should do a lot more work on it
though.

* Update IETF-RFC.md

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>

* Update IETF-RFC.md

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>

* Update IETF-RFC.md

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>

* Update IETF-RFC.md

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>

---------

Co-authored-by: Giuseppe Lo Presti <giuseppe.lopresti@cern.ch>

Author: mickenordin

IETF-RFC.md

@@ -897,6 +897,34 @@ request or not.
 # IANA Considerations
 This document has no IANA actions.
 
+# Security Considerations
+## Trust
+There are several areas that are not covered by this specification. Most
+importantly we do not provide a way of establishing trust between
+servers, even though some features of the protocol rely on trust, such
+as the `mfa-enforced` requirement.
+
+Trust needs to be established out of band, but there are some features
+of the protocol that _can_ be used to assist operators in establishing
+trust. For instance, invite flow can be used to establish that users
+know and have out of band connections with other users on an OCM server.
+
+Further more the Directory Service feature can be used to establish a
+trusted federation, where a central authority can be trusted to
+implement measures for auditing and adding only trusted servers into the
+discovery service.
+
+### httpsig
+It is recommended to use signed messages to verify that an OCM server
+is the server you expect it to be, and should be done unless you have
+a niche use case. 
+
+## Legacy shared secrets
+The legacy format of an OCM Share Notification with shared secrets is
+only provided for backwards compatibility with existing implementations.
+Implementers SHOULD NOT use it and prefer short-lived tokens instead.
+
+
 # Appendix A: Multi Factor Authentication
 If a Receiving Server exposes the capability `enforce-mfa`, it
 indicates that it will try and comply with a MFA requirement set on a