The background is probably this email thread: https://www.ietf.org/mail-archive/web/tls/current/msg21278.html https://www.ietf.org/mail-archive/web/tls/current/

The background is probably this email thread: https://www.ietf.org/mail-archive/web/tls/current/msg21278.html https://www.ietf.org/mail-archive/web/tls/current/msg21278.h... Previous discussion of that email thread: https://news.ycombinator.com/item?id=12641880 https://news.ycombinator.com/item?id=12641880 Basically, someone noticed (too late) that TLS 1.3 no longer has the RSA key exchange, which they liked because it allowed decryption of the encrypted traffic by passive middleboxes (which have a copy of the RSA private key). This draft is probably a response to that.