Great summary. The user's threat model could be more succinct and address the question of what the end user is really protecting, and from whom. Then the featur

Great summary. The user's threat model could be more succinct and address the question of what the end user is really protecting, and from whom. Then the features of the different protocols would be mitigations to that risk. I've got a horse in the race, but I might use it as an example input for the method in this post: https://www.qtra.io/simpletm https://www.qtra.io/simpletm Short version would be, <end user> wants to protect the <confidentiality and integrity> of the <contents of their browsing history> from: <isps> who <using it to target ads and sell to 3rd parties> <intelligence agencies> who <are engaged in bulk collection> <employers> who <use browsing history as leverage to manage out staff.> etc. We need the who, why, and what, before the how. Excellent summary all around though.