I guess this is exactly why this is over my head. Maybe you can help me even though it's a little unfair to pick on you :) If one can decrypt the conversation that negotiates the session key and thereby obtain the session key, couldn't one also read the conversation? This must be the whole trick to the ephemeral part...
And to link it back to the outer conversation... Since google is using PFS for gmail, for the NSA to read those conversations, google would either need to (a) give them the email unencrypted directly (cheating) or (b) give them the specific key negotiated for each conversation.
It strikes me that once PFS is in place, google would, in theory, be able to keep everything private except those conversations that a court forced them to give up the keys for.
As long as the rule of law were upheld (i.e., warrants/judicial involvement), it seems to me that this model could work and be generalizable for all web traffic. Maybe it's the way forward...
