Clarify behaviour of deletion with untrusted hosts

Reading of the original explanation of how encrypted sync works might
make one assume that deleting an encrypted copy of a file would be
synchronised as a deletion onto plaintext hosts. This is not the case,
so explicitly clarify this.

Author: WhyNotHugo

users/untrusted.rst

@@ -58,6 +58,10 @@ becomes available.
         T2 -> U1 [label="Encrypted by T2"]
     }
 
+In the above scenarios, if the untrusted device U1 deletes a local copy of a
+file, this is not replicated directly to trusted hosts. Untrusted hosts might
+receive the notice, however.
+
 Similarly, it's fine to add "normal mode" synchronization between untrusted devices.
 
 .. graphviz::