> PFS for message objects, as the description above suggests, is far more difficult, and contrary to the nature of email.
It recommends just rotating public keys every few days with a paranoid mode. A much better solution is to implement the Axolotl Ratchet pioneered by Open Whisper Systems for TechSecure:
https://www.whispersystems.org/blog/advanced-ratcheting/
https://github.com/trevp/axolotl/wiki
With Axolotl Ratchet, you get:
* forward secrecy - disclosure of private keys doesn't let an attacker in the future go back and read encrypted communication
* future secrecy - disclosure of ephemeral private keys doesn't disclose (much) future content
I also get the feeling from a glance reading the spec that way too much trust is being placed on service providers. That there is even such a category as "trustful" where the server has access to your private keys is a huge red flag and that was exactly the problem with lavabit: http://www.thoughtcrime.org/blog/lavabit-critique/