So the server and device securely agree on something like TOTP list (weak keys with expiration date), so intermediate data can be authenticated within those time windows? But if that applies to encryption too, then won't later bruteforced decryption pose a threat?