Define Network peer trust roadmap

[rchatham]

Summary

• Add a dedicated Network backend trust model plan.
• Require at least 32 CSPRNG-generated PSK bytes and document provisioning, scoping, storage, rotation, and reuse constraints.
• Distinguish TLS-PSK group membership from individual peer identity.
• Document display-name/identifier spoofing by an authorized PSK-group member.
• Evaluate future HKDF-derived pairwise keys, signed identity binding, certificate/pinning, and app-provided verification.
• Define security gates before the Network backend is production-ready or becomes default.

Scope

Documentation only. This does not change the default backend, transport behavior, runtime authentication, or public policy API.

Security boundary

The current fixed TLS PSK identity is a label selecting the shared key, not an authenticated endpoint identity. Bonjour metadata and handshake identifiers/display names remain self-asserted. Any PSK holder can establish a valid group-authenticated TLS connection while claiming another member's name or identifier; apps must not use those values alone for authorization or trustworthy audit attribution.

These are pre-existing limitations of the explicitly experimental opt-in backend; this PR documents them and does not introduce a new runtime security issue.

Verification

• swift test — 113 tests passed.
• xcodebuild test -project PeerConnectivity.xcodeproj -scheme PeerConnectivity -destination 'platform=iOS Simulator,name=iPhone 16,OS=18.3.1' -configuration Debug — 113 tests passed.
• Correctness review: no merge-blocking findings.
• Security review: no merge-blocking security findings.
• Claims checked against project source, Apple Security framework SDK headers, RFC 8446, and RFC 5869.

Follow-up

Select and security-review an individual identity mode before describing the Network backend as production-ready or changing the default backend. Implementation must bind an authenticated principal to the connection before connected/data events and identity-based duplicate resolution.

[rchatham]

Superseded by consolidated PR #48. No commits were discarded; this branch is preserved as a recovery and reference point. Addressed review findings were replied to and resolved before consolidation.