Specify how PrivCount in Tor statistics are configured and interpreted
In prop#280 prop#288, we specified the counters, noise, and secure aggregation for PrivCount in Tor.
Now we need to specify:
- how long each collection round goes for
- how we determine which counters are collected
- how we configure the amount of noise for each counter
- how Metrics can interpret the final results
We should also try to answer the unanswered questions in prop280.