Add recommendation for deletion of init_keys

[TWal]

Because the joiner_secret is encrypted to the init_key of joiners, if the joiners don't delete their init_key after processing a Welcome, this could undermine forward-secrecy. I noticed that the document don't give any precise recommendations about that.

There are some hints scattered in the document, but they give recommendations to participants adding other participants, not to participants being added:

mls-architecture/draft-ietf-mls-architecture.md

Lines 670 to 672 in b091b3a

	In order to avoid replay attacks and provide forward secrecy for messages sent
	using the initial keying material, KeyPackages are intended to be used only
	once. The Delivery Service is responsible for ensuring that each KeyPackage is

This PR adds a recommendation for that. I am not sure on how to proceed, I have made an attempt but it might belong to another section!

[TWal]

Thinking more about init keys, we should also recommend to regularly rotate key packages that are on the delivery service, even if they are not used. This could otherwise undermine post-compromise security: the attacker could compromise the initialization key of someone, and when the corresponding key package is added in a group later (e.g. several months after the compromise) the attacker can decrypt the messages exchanged in this group, until the participant updates.

[TWal]

There are some hints that key packages must expire:

mls-architecture/draft-ietf-mls-architecture.md

Lines 1819 to 1822 in b8893e0

	Because the DS is responsible for providing the initial keying material to
	clients, it can provide stale keys. This does not inherently lead to compromise
	of the message stream, but does allow it to attack forward security to a limited
	extent. This threat can be mitigated by having initial keys expire.

but I think kind of attack undermines post-compromise security rather than forward secrecy.

[TWal]

I am wondering, should it be a "RECOMMENDATION"? It seems that other "RECOMMENDATION" are about things that can only be done in a best-effort way, whereas deleting initialization key upon Welcome processing seems to always be doable.

[TWal]

I opened #274 to discuss KeyPackage expiration.

[seanturner]

In WGLC; see this.