If the server is compromised, of course the attacker can impersonate the server. With an _augmented_ PAKE (which OPAQUE is), the attacker cannot impersonate the

If the server is compromised, of course the attacker can impersonate the server. With an _augmented_ PAKE (which OPAQUE is), the attacker cannot impersonate the client without a brute forcing step.