The SEC report regarding the DAO token states that is was indeed a security and that the ICO providers and the investors themselves were violating federal securities laws. What happens legally if a token a US resident bought/sold in the past is classified as a security by the SEC in the future?