Revise security analysis

[sbuc]

• [x] each property (privacy and verifiability) vs. adversary model (both malicious witness and passive observer of S) (ensure we cover everything!)
• [x] explicit statement on whether/how CROCUS preserves the property against the adversary (more conclusion, what constraints/assumptions).
• [x] Trusted witness boils down to trustworthiness.
• [x] Threshold: vulnerable to collusion of \theta or more colluding witnesses.
• [x] Do analysis with Jane, mention threshold ("variation of the protocol").
• [x] Spatial eligibility, mention DB: trusted witness performs DB, propagates to verifier through trust.
• [x] Emphasize that we include malicious P too.
• [ ] Malicious witness is at worst no witness.
• [x] Reduce to trust in witnesses.
• [x] Fix edits from here.

[dbosk]

Related to #165.

[dbosk]

Not sure how to squeeze in that malicious witnesses are at worst no witnesses. It's basically not part of the verifiability adversary, since a malicious witness makes most sense against the privacy of a protester.

Maybe point it out in the discussion? Any ideas?