Expand TODO for CVE-2019-11599

The CVE assignment looks to be a duplicate of CVE-2019-3892 but there
needs clarification if so, and which one to be used.

oss-security thread at
https://www.openwall.com/lists/oss-security/2019/04/29/2 points out the
possible duplication for further clarification.