Bloom Filter Encryption and Applications to Efficient Forward-Secret 0-RTT Key Exchange