User client requests a public key from Steam's servers (rotated each hour), and sends passwords encrypted with it.