You&#x27;re right, DH might be enough, depending on goals.<p>The DH exchange would be MITMable, but not passively collectable. TLS is (ideally) neither, so DH wouldn&#x27;t provide an equal level of privacy.<p>Still, it would be a beneficial extension of the protocol. At the cost of an additional TCP RT.