Couldn't you just generate new keys each session and keep forward security?