Earlier quoted context omitted.
When a server doesn't use forward secrecy, it looks like this: While it's working correctly (which involves you knowing the private key), you know everything it sends. If it gets compromised, it might keep using the same key and you know what it sent, or it might start using a different key and you'll never figure out what it sent while compromised. When a server does use forward secrecy, it looks like this: While it…
> What meaningful difference is there? There would not be a meaningful difference in terms of being able to tell if it was compromised. There would be a meaningful difference that you would now have an operational exposure of the session keys, that fundamentally undermines not just PFS but potentially the encryption protecting the session in general. > You can verify what it sent, but that doesn't prove it wasn't com…
That's no worse than before, where you could use the private key to undermine the encryption.
You could also end up with a much better system if you encrypted the session keys so that only the auditing device can decrypt them.