Maybe. Still requires a re-encryption of the symmetric session key for every recipient - effectively proof of work. "stretching" the equivalent of rsa(session_

Maybe. Still requires a re-encryption of the symmetric session key for every recipient - effectively proof of work. "stretching" the equivalent of rsa(session_key, public_key) might be feasible?