ss1 = pk1 * esk0

bf1 = derive(ss1)

ss2 = pk2 * esk * bf1

ss1 = sk1 * epk0

bf1 = derive(ss1)

ss2 = sk2 * epk * bf1