PFS support

- make DH and ECDH configurable

- choose defaults

- select option to NOT reuse secrets