Past-traffic decryption via omitted ephemeral key exchange

Lack of forward secrecy in Briar before 1.5.3 allows attackers to decrypt captured traffic after compromising both accounts. The Bramble Handshake Protocol omits the ephemeral-to-ephemeral X25519 result from the master-key hash, allowing retained static handshake secrets and a recorded transcript to reconstruct past keys. Exploitation requires capture of the handshake plus later compromise of both accounts, but Briar routes every such handshake through encrypted Tor v3 hidden-service sessions, which prevents the required capture.