The security model is one of the hard parts that needs working out, yes. This is just an announcement that there is a plan to work one out in case people want to participate instead of just having stuff dumped on them from on high when it's done the way Google and Apple do it.