Threats discussed on the messaging list at moderncrypto.org

[azul]

• explain why we need non-malleability
• explicitly mention QR codes need to be confidential
• add expiry and reuse considerations

[r10s]

looks good to me, esp. the timeout for the INVITENUMBER was reported/requested several times in the delta chat channels.