Add Security Consideration on signing status list

[PieterKas]

It may be a good idea to add guidance on the implications of not signing the status list to make the security trade-offs explicit.

[c2bo]

Thanks for opening the issue and I agree, we should probably be a lot more explicit for this part.
Biggest question would be where this fits? Perhaps a general introduction at the start of section 5?

[paulbastian]

Editors Call Discussion:

• Add security consideration for now
• Discuss if the unsigned option should stay in or not for the long term (usefulness/security/less options)