I'll admit that my concerns are mostly theoretical (and you're absolutely right that _only_ offering AES-128 is a bad idea). The related key attacks don't appl

I'll admit that my concerns are mostly theoretical (and you're absolutely right that _only_ offering AES-128 is a bad idea). The related key attacks don't apply in TLS (but still if the majority of the known attacks only apply to the higher key sizes, that sets my tin-foil a'tingling), and as far as speed goes, the bulk encryption cipher is never going to be the bottleneck, no matter the key size. It's also a matter of the right tool for the job. Why get out the 2# sledge hammer when the claw hammer will pound that nail in just fine? They'll both get the job done, and to a lay person, they might both look like the 'right' tool. The claw hammer is obviously the more 'elegant' tool though.