outline define stateless what to protect, how to parameterize what is the threat model what can we realistically measure what technical facilities do we have need to protect user privacy need for community buyin on an international scale need for secrecy