Recoverability as a First-Class Security Objective