Each connection's keys are derived from a secret that is erased after deriving the keys and the secret for the next connection.