It seems to do a good job of not stating the actual threat model anywhere.