Clarify why signing isn't enough...

[JustinCappos]

The security page should clearly explain why simply signing isn't enough. You have to read between the lines to get this now...
https://theupdateframework.github.io/security.html

[JustinCappos]

@justincormack If you get a chance to add your text here, it would be appreciated. If you want me to do so instead, just forward what you wrote and I'll work it in!