Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.