[tptacek]

The attacks we're talking about aren't chosen plaintext; they're CCA2. And, in fact, RSA retains CCA2 vulnerability in its most common "padding" mode.