>...they also get all of your messages after 2015, because they could use the long-term key from the backup to decrypt all your captured network traffic. They

>...they also get all of your messages after 2015, because they could use the long-term key from the backup to decrypt all your captured network traffic. They would get all your messages after 2015 if they were willing and able to MITM the Diffie-Hellman handshake used in the forward secrecy scheme. Otherwise there would be no point in having long term identity keys in the first place. Your example brings up an interesting point for me. Perhaps forward secrecy is more important in systems that trade off secrecy for convenience by failing to protect the private keys with a strong passphrase. In that case forward secrecy is more valuable due to the larger chance of a private key compromise. I guess the same point would apply to deniability as well. So thanks for the discussion and generated insight.