>Also, no forward secrecy. My understanding of OTP's implies that these must be used only once. As such they offer the same PFS as all the schemes I know of. P

>Also, no forward secrecy. My understanding of OTP's implies that these must be used only once. As such they offer the same PFS as all the schemes I know of. PFS does not guarantee the secrecy of a specific message. It does guarantee that if you are able to crack one message you can't use the key to crack others. Therefore if you use an OTP only once it gives you the same guarantees.