Comment by AlexCoventry

Is there a way to do forward security in a non-interactive protocol (which seems necessary, if you want to communicate over email?)

I guess users could publish partial key exchanges out of band?