I think Paul said it was because we weren't hashing the shared point, so it reduces the entropy on the original key