Add privacy consideration

[Nat Sakimura]

Non-repudiation has privacy implications.

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/406

[Nat Sakimura]

• Evaluate if the message needs to be stored. When using Message Signing, it is likely that the entire message is going to be stored as otherwise, the signature will break, unlike in the case of unsigned messages. This will create an additional privacy risk.
• Therefore, if storing the message, then implementations should take a more rigorous analysis of the data minimization: e.g., who is allowed to access it, how it should be redacted before being presented to the person or systems, etc.
• A party with multiple pseudonyms may use the same key to sign, which may cause associability..?
• Key sharing among the apps from a same publisher sharing keychain so sharing a private key could cause an unexpected correlation for a user.

‌

[Dave Tonge]

Nat - is it possible to get a PR for this? Thanks

[Nat Sakimura]

Will do.