[TLS] Remove DH-based 0-RTT

[Martin Thomson <[e-mail]>]

Now that the other issue is in the bag, let's talk about making some
real savings.

I propose that we remove DH-based 0-RTT from TLS 1.3.

As ekr's previous mail noted, the security properties of PSK-based
0-RTT and DH-based 0-RTT are almost identical.  And DH-based 0-RTT is
much more complex.

For those who love DH-based 0-RTT, and I know that some people are
fans, here's something that might make you less sad about removing it
from the core spec.  You can use DH out of band to negotiate a PSK.
You might even do this as an extension to TLS, but that's of less
value.

If you - for example - had the offline configuration from
https://unicorn-wg.github.io/tls-offline-config/  then you could
simply state that using the included configuration identifier caused
the session to have a "PSK".  That "PSK" could be a value derived from
a shared secret (g^xs) plus maybe HKDF that took the configuration as
a label input.

Then you get something that follows Hugo's existing analysis.  What
you don't get is in-TLS server configuration, but we've established
that we don't really need that.