Well, part of the reason they're quite rare is because not a lot of people want what it has to offer :-) EC scalar multiplication is typically a bit faster than RSA decryption; sometimes PFS isn't a desirable property because you actually *want* to be able to decrypt things after the fact. And it has the minor benefit that your cert can be a bit smaller I suppose ;) But yes, *most* people don't want this at all, and that's why you probably haven't ever dealt with this beyond seeing it show up in `openssl ciphers`.