[Privacy-pass] context unlinkability

[Nikita Borisov <[e-mail]>]

The current architecture document defines three types of unlinkability
(Origin-Client, Attester-Origin, and Issuer-Client). These maintain client
privacy within any single context. However, I think an important
property of privacy pass protocols is that the issuance (and attestation!)
contexts should be unlinkable to the redemption context. This is actually
mentioned in the Overview under point 5, but it isn't listed among privacy
goals. I added a pull request (361) to add this property to the
architecture document.

I think this is important because without it, an issuance protocol that
adds, e.g., a serial number to each issued token which MUST be shown at
redemption time would still satisfy the three original unlinkability
properties.

Thanks,
- Nikita