PFS is possible only with id-based encryption and something nuts....

so let's skip it for now and let others work on it....