I can't think of more defences, but they briefly mention the possibility for websites to mine DDoS coins against themselves and I think it's an interesting pers

I can't think of more defences, but they briefly mention the possibility for websites to mine DDoS coins against themselves and I think it's an interesting perspective. I don't know the algorithms involved in the key exchange well enough, but if they support bulk optimizations like RSA does (it's faster to do thousands of signatures in a single operation, rather than one operation at a time) then the server has a noticeable advantage on clients - to the point where it could drive the difficulty insanely high and make it unprofitable to mine DDoS coins.