A new public key per password-mutating session is quite an interesting idea. It does have some challenges in introducing a read-before-write to fetch the sessi

A new public key per password-mutating session is quite an interesting idea. It does have some challenges in introducing a read-before-write to fetch the session key at the start of the session, but given the relatively low call volume of such flows that might be a small price to pay to simplify security audits and de-risk changes to any service in the call chain.