Inclusion of attack vectors and mitigations?

Do we want to include attack vectors in boundaries described in 2.1-2.3, along with mitigations? This is veering into threat model territory, so I'm not sure it belongs here.
### 2.1 Issuer–User Boundary
- **Potential Attack Vectors:**
- Compromised issuer private keys
- Fraudulent credential issuance
- Man-in-the-middle attacks during credential delivery
- Impersonation of legitimate issuer

### 2.2 User–Verifier Boundary
- **Potential Attack Vectors:**
- Replay attacks using captured proofs
- Stolen credentials
- Compromised client devices
- Time manipulation attacks
- Side-channel attacks on proof generation

### 2.3 Mathematical and Implementation Trust
- **Potential Attack Vectors:**
- Implementation vulnerabilities in ZKP libraries
- Quantum computing threats to underlying cryptographic assumptions
- Side-channel attacks on implementation