In ~~prop#280~~ prop#288, we specified the counters, noise, and secure aggregation for PrivCount in Tor. Now we need to specify: * how long each collection round goes for * how we determine which counters are collected * how we configure the amount of noise for each counter * how Metrics can interpret the final results We should also try to answer the unanswered questions in prop280.