Another night's work - move to ECDH + AES256 from RSA pubkey