• "do nothing" inaccurately describes the credential-considerations draft that it currently links to
• Rick Byers risks.md link is 404 (maybe point to this history, or @RByers can propose an update that includes that portion of the original content)
• update terminology to describe alternative as "do nothing and accept the risk" or "accept the alternative risk of other deployments" per @simoneonofri

follow-up from #354