Forward secrecy PFS
Security property: even if the server key later leaks, previously eavesdropped traffic can't be decrypted.
Technically: each session gets a unique short-lived key via Diffie-Hellman. Ephemeral DH = ECDHE. Defence against "harvest now, decrypt later". Required in TLS 1.3 — older TLS versions often lacked PFS.