If you keep your messages around in some form then that effectively defeats forward secrecy. In any case where the attacker can get your secret encryption key m

If you keep your messages around in some form then that effectively defeats forward secrecy. In any case where the attacker can get your secret encryption key material, they will be able to get any messages you still have access to. Most people want to keep their old messages around. So for messaging, forward secrecy is of little practical value. If you do keep your messages around, then PGP's encrypt once[1] scheme is much better than what most other systems do. The message is encrypted and stays encrypted. It is never in a decrypted state unless the user wants to look at it. This normally involves the entry of a secure passphrase. Contrast that with typical instant messengers where the security of retained messages is entirely up to the device security. The implementation of a forward secrecy scheme ironically makes this more likely. Once the session key is deleted, the easiest way to keep the message around is to leave it as plaintext. So the user either has to turn on self deleting messages and lose those messages, or has to leave those messages available to potential attackers. BTW, "forward secrecy" is a terrible term for usability. Something like "message burning" much better fits with a typical users conceptual context. [1] https://articles.59.ca/doku.php?id=pgpfan:encryptonce https://articles.59.ca/doku.php?id=pgpfan:encryptonce