3 reasons 1. it's reasonable to assume the NSA is a decade ahead and has more computers than academia. 2. you want your secrets to last a decade (or longer)

3 reasons 1. it's reasonable to assume the NSA is a decade ahead and has more computers than academia. 2. you want your secrets to last a decade (or longer) 3. the total amount of data you're encrypting per client is only 256 bits anyway (the size of a symmetric key) so the absolute performance impact is relatively minimal