A statistically rigorous model for tornado hazard assessment