> a session key which was itself encrypted using Public Key cryptography based on the public key in the certificate This all depends on the ciphersuite used by

> a session key which was itself encrypted using Public Key cryptography based on the public key in the certificate This all depends on the ciphersuite used by the client and server. In TLS 1.2 some ciphersuites use forward-secret methods (typically "DHE" and "ECDHE"), and some don't. In TLS 1.3 you always get the benefits that you mention, but in TLS 1.2 and earlier you sometimes get them. :-)