Looking at the RFC for PGP email/asynchronous chat with PFS here https://datatracker.ietf.org/doc/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good?
Alice and Bob retrieve each others long-term public keys. When Alice sends the first email to Bob, she encrypts her message with Bob's long-term public key, generates a one time public key and signs it with her long-term private key and includes it in her email to Bob. Bob receives the email from Alice, and when replying, uses Alice's one-time public key to encrypt his message, and also includes his reply email a one-time public key signed with his long-term private key. etc etc. Of course, one-time public/private keys are deleted once they're used to decrypt a message, just as ephemeral Diffie-Hellman keys are deleted in something like ECDHE.
This provides PFS for Bob, and basically PFS for Alice (excluding the first message of Alice).
Why is this scheme not widely-used in PGP? Is it just because key generation takes a few moments? Or that, Alice having multiple communication partners (that might take forever to reply) means storing multiple one-time private keys? (This can of course be mitigated by making the one-time private keys expire after a short time, eg., one week like with Pond).
(by the way, I'm not really suggesting this as a revolutionary scheme. I'm genuinely trying to understand asynchronous messaging better, and destroying this basic PGP scheme would be helpful in my understanding).