Explain identity exposure attack

[ekr]

My sense of the discussion on the list (and talking to the chairs) is that there is not consensus to make a change. This just attempts to document the situation.