Define a threat model for secrets used in infrastructure

[hellais]

We have several secrets stored inside of the ansible vault which we should properly assess the threat model for.

Once we have a threat model we can understand how well we are doing and what we can do to improve the security of how we handle secrets distributed across our infrastructure.

Related: https://github.com/ooni/sysadmin/issues/258

[hellais]

Another aspect to evaluate as part of this is also secrets related to signing of applications.