It seems to me you haven't understood PFS. (Elliptic-curve) Diffie-Hellman protects the session key only as long as the (elliptic-curve) discrete logarithm prob

It seems to me you haven't understood PFS. (Elliptic-curve) Diffie-Hellman protects the session key only as long as the (elliptic-curve) discrete logarithm problem is hard. Here's how, in a simplified nutshell: - A sends g^x to B; - B sends g^y to A; - A and B agree on the session key H(g^xy); - An attacker that can solve the discrete logarithm finds x from g^x; - The attacker finds the session key by computing H((g^y)^x).