Add reference to handshake

draft-ietf-quic-transport.md

@@ -5973,10 +5973,10 @@ at a future time; this is true for any observer of any packet on any network.
 A blind attacker, one who injects packets without being able to observe valid
 packets for a QUIC connection, is unlikely to be successful, since packet
 protection ensures that valid packets are only generated by endpoints which
-possess the key material established during the handshake.  Similarly, any
-active attacker that observes QUIC packets and attempts to insert new data or
-modify existing data in those packets should not be able to generate packets
-deemed valid by the receiving endpoint.
+possess the key material established during the handshake; see {{handshake}} and
+{{handshake-properties}}.  Similarly, any active attacker that observes QUIC
+packets and attempts to insert new data or modify existing data in those packets
+should not be able to generate packets deemed valid by the receiving endpoint.
 
 A spoofing attack, in which an active attacker rewrites unprotected parts of a
 QUIC packet that it forwards or injects, such as the source or destination