What attacks does future secrecy protect against?
It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?


It is assumed that the messaging devices erase the decrypted messages (and expired private keys) from memory, hence there's nothing to read.