add SECURITY.md

[pinheadmz]

Closes #199

[coveralls]

Pull Request Test Coverage Report for Build 534851082

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.02%) to 59.721%

---

Totals
Change from base Build 534797126:	0.02%
Covered Lines:	19590
Relevant Lines:	30577

---

💛 - Coveralls

[tynes]

Besides the two comments, I think another possibility would be to include the pubkeys themselves directly in the SECURITY.md. This means that there is a chance they could go stale as it would be another place to have to remember to update them. Having them in git is kind of nice though

[pinheadmz]

Added my own email and key, and specified a keyserver in the example command where both my and JJs key can be downloaded. I think that and keybase are sufficient sources. Both of those systems are well-known PKI and users may have social "connections" or trusted peers in common, etc which I think is a bit more pro than hosting the keys inside the git repo. Keybase in particular also verifies twitter, reddit and github so I think thats a good way to serve the keys.