I agree that the risk of replays due to TLS 1.3 0-RTT is bad, but I understand browsers (e.g. Chrome) can often be made to silently replay requests at a lower T

I agree that the risk of replays due to TLS 1.3 0-RTT is bad, but I understand browsers (e.g. Chrome) can often be made to silently replay requests at a lower TLS version anyway (to work around middleboxes that choke on higher-than-expected TLS versions.) So avoiding TLS 1.3 0-RTT doesn't avoid replays... and yes, this is bad. https://twitter.com/XorNinja/status/1357828529610608641 https://twitter.com/XorNinja/status/1357828529610608641 may be(-come) relevant. (Sorry, your post is already a day old as I type this. You might still see this response?)