so, my understanding of crypto comes solely from HN comments, articles and Cryptonomicon. I assume i will be wrong on most points:

1)if someone is somehow monitoring the mobileP2P connection between you and your friend they could conceivably crack the 256 RSA jumble to obtain the 1time pad

2)if someone gains access to your device they could obtain the QR image and (1)

i bet there are other possibilities via hardware and ????

from my lay POV, this does seem like a promising idea.