I don't think it needs to be that complicated. Just add a new comment field that contains the session key in plaintext. Neither the server nor client ever knows

I don't think it needs to be that complicated. Just add a new comment field that contains the session key in plaintext. Neither the server nor client ever knows the difference.