It is the server attack we are worried about, perhaps you should be signing the session key?