I'm completely overwhelmed by security topics, so please pardon this stupid question. But could you expound on this part:

But ultimately, the conditions necessary for this type attack are not generally realistic, and I don't believe it should be characterized as a real risk.

Shouldn't it be possible to factor out the network jitters? I'm reminded of this post by Nate Lawson about Keyczar.

http://rdist.root.org/2009/05/28/timing-attack-in-google-key...

Is this attack unrealistic because taking enough samples to factor out the jitters would be very obvious to an administrator? Or is it exceedingly unlikely that a public network will ever have low enough latency to perform this sort of timing attack on this particular vector? Or am I misunderstanding your point entirely?

I really appreciate your taking the time to explain this stuff to people like me! Its fascinating.