Forward secrecy

Forward secrecy limits retrospective damage from a compromised long-term key. It relies on appropriate, regularly renewed ephemeral keys rather than merely deleting old messages.

Membership changes and epochs are particularly relevant for groups. The property becomes verifiable through protocol documentation, test vectors and an implementation that actually removes old keys.