to resolve this issue for a future ECC security policy
I would like to suggest the following changes to the protocol.

When a ECC SecureChannel is renewed, the ECDH algoritm is used
to generate the shared secret, and the key derivation uses

IKM0 = the x-coordinate of the shared secret of the initial handshake
IKM1 = the x-coordinate of the shared secret of the first renew
IKM2 = the x-coordinate of the shared secret of the second renew
etc.

The key derivation algorithm as defined in part 6,
6.8.1 Secure Channel Handshake, uses for the first renew

IKM = IKM0 xor IKM1

instead of deriving the session keys directly out of IKM1,
and for the second renew

IKM = IKM0 xor IKM1 xor IKM2

etc, etc.

So it is impossible to know the session keys unless all ECDH secrets are
known, including the ECDH secret from the initial handshake.

This should prevent any successful session take-over attack.