text on 3rd party libraries and TLS-based sender constraint methods

[tlodderstedt]

[danielfett]

#34 needs to address this

[tlodderstedt]

I think this text should go into the SPA BCP