Explain need for ZF to see true well-known data

[richsalz]

Fixes: #2

[bemasc]

I would prefer a more specific assignment of responsibilities, like:

• The ZF MUST fetch it securely from the relevant origin.
• An HTTP Gateway MUST NOT modify or inject the resource.
• These rules can be changed by private arrangement.

[richsalz]

Fixup commit added that adds the specific assignments.