PFS doesn't prevent inspection of traffic, it just makes passive capture more complicated since you now need to log the ephemeral keys for each connection rathe

PFS doesn't prevent inspection of traffic, it just makes passive capture more complicated since you now need to log the ephemeral keys for each connection rather than just using the private key to decode the whole package. Not necessarily trivial but not exactly impossible for someone who controls one of the endpoints. Active interception with a middlebox still works exactly the same as it always has.