Fantastic threat models: building a death star the rebels won't destroy