Forward Security is about creating a single session key and then ensuring that it isn't trusted after the session. This is a good best practice and SHOULD be u

Forward Security is about creating a single session key and then ensuring that it isn't trusted after the session. This is a good best practice and SHOULD be used everywhere. It does not prevent any attacker, government or otherwise, from making client implementations do things like: * add in third party key distribution (backdoor the conversation) * send a 'backup' of keys or other details to a central server * directly man in the middle by only establishing a "secure" connection to a middle server * compromise the situation in other ways; E.G. using a flawed "random" source BTW, if you can't build the client your self from source, how do you KNOW the above isn't being done?