Agreed. `ECDHE` should be used while `OP_SINGLE_ECDH_USE` is IMHO overkill - unless you worry about the attacker capturing live memory dumps .. at which point one the app/host is deeply compromised anyway.