Torbrowser's updater integrates additional protections from Thandy's threat model