Privacy impact of connection coalescing

[mnot]

Folks in the Tor community point out that coalescing connections is a genuinely new vector for tracking users in HTTP/2.

This should be pointed out in the Privacy Considerations subsection of Security Considerations, along with mitigations.

While we're there, more specific text about mitigating HTTP/2-specific fingerprinting would be nice.

[mnot]

@martinthomson, I've marked this as Design, but I think we can prepare a proposal pretty easily. You want to take a crack at it, or should I do a pull?

[martinthomson]

I'm happy to take input. Since I'm basically offline this week, getting a start would help lots.

[mnot]

Marked as editor-ready; please consider list feedback.