> Moreover, RSA key generation is massively slow-- Not only is it extremely slow, but it's also non-deterministically slow -- there's no constant-time way to r

> Moreover, RSA key generation is massively slow-- Not only is it extremely slow, but it's also non-deterministically slow -- there's no constant-time way to randomly generate an RSA key, because searching for suitable primes is a "guess-and-check" process. ECC key generation, on the other hand, is so fast that it's perfectly feasible to use it as part of the session negotiation process (e.g. in ECDHE).