> What changes here is that if you deployed SSH/TLS using a HSM (Hardware security module), you'd need to be prepared to provide a plaintext stream upon a court

> What changes here is that if you deployed SSH/TLS using a HSM (Hardware security module), you'd need to be prepared to provide a plaintext stream upon a court order. Obviously, the alternative is to choose the non-HSM route which is, and has always been, vulnerable to subpoena. Forgive me if I'm wrong, but doesn't SSH always use a Diffie-Hellman key agreement, where the keys are destroyed after their use? No subpoena has the power to recover keys destroyed in the past, even if no HSM had been used. The same applies to modern TLS using DHE or ECDHE suites, and AFAIK the current TLS 1.3 proposal allows only these suites. They might be able to subpoena the authentication keys, but these are useless to recover the ephemeral keys of past connections (except from older TLS cipher suites which didn't use DHE/ECDHE), and even for future connections they would have to be used with an active attack.