Enforcing tombstones instead of deleting documents

[benlongstaff]

From the confidential storage working group discussion and spec

"Delete Resource (Document or Stream): Deletes the encrypted resource (note that a tombstone object should remain behind for replication purposes)."

• Verify how tombstones is currently enforced.
• Check that the database access permissions don't allow users / applications to delete documents

[tahpot]

CouchDb uses _deleted property, this ensures replication of deletions occurs across nodes. No action required.

Database owners can complete whole databases, but not hard delete individual docs.