This is one of those discussion where when I point out mistakes that (a) everyone makes and (b) you haven't thought of before and (c) are exploitable whether or not you encrypt, you're going to say "oh, well, you just shouldn't make those mistakes", and so I'm not interested in pursuing this and am content to rest my case.