Document how the web relies on transport security

At IETF105, @DKG explained a worry that I think several people have: The web's only current security system is based on proving that the transport channel is connected to an appropriate endpoint. Signed Web Packages try to replace that with object security, proof that the right person signed the resource at some time. Since the web is big, it's hard to be confident that we're not going to break anything by making that change.

So, we should try to make a complete list of how the web tries to be secure, describe how those attempts rely on transport security, and describe how that's affected by a switch to object security.

Start with the security concerns described for IETF105 and the issue's discussion of Signed Web Packages and object security. Build a complete inventory of web security mechanisms, then document how each relies on transport security and how that reliance changes with object security; done means the list and impact descriptions are comprehensive.