ECDH has smaller keys. youtu.be/gAtBM06xwaw?t=634 mentions some interesting downsides:
  • bad curves exist, while in modular, any number seems to work well. TODO why?
  • TODO can't find this mentioned anywher else: Diffie-Hellman key exchange has a proof that there is no algorithm, ECDH doesn't. Which proof?