Write a proposal for using two guards, not one

See tor-dev discussion. This is a roadmapped item.