Why is public-key cryptography mainly used for key exchange?

Concept

Any key-exchange scheme must solve the key-distribution problem: two parties who share no prior secret need to agree on a value that stays secret from an eavesdropper, without ever sending that secret value in the clear. A symmetric cipher (e.g. AES) uses the identical key to encrypt and decrypt, so it gives no way to bootstrap that shared secret in the first place -- some other secure channel would first be needed just to hand the key over. Public-key (asymmetric) cryptography breaks this circularity: each party publishes a public value openly while keeping a matching private value that is never transmitted -- in some schemes (e.g. RSA) the public value encrypts and only the private value decrypts, while in others (e.g. Diffie-Hellman) the two sides use their paired public/private values to independently compute the same shared secret without either exchanging it directly.

Application

Public-key methods are therefore used mainly for key exchange because they let two parties agree on a shared secret using only publicly exchanged information -- no secret ever has to be shared beforehand. This is exactly why hybrid protocols such as TLS use an asymmetric step (RSA key transport or Diffie-Hellman key agreement) only to establish a session key, and then switch to a fast symmetric cipher such as AES for the actual data, since symmetric encryption is far cheaper once a shared key exists.

Cross-check

This matches standard cryptographic key-management guidance (e.g. NIST SP 800-57): symmetric algorithms are computationally far cheaper per byte, so speed alone would favour using only a symmetric cipher -- yet systems still add a public-key step specifically for exchange, which rules out speed as the reason. A public key's certificate also carries a defined validity period and is rotated or revoked over time, so key exchange cannot be explained by public keys never expiring either. Only the ability to avoid pre-sharing a secret beforehand explains why public-key cryptography is chosen specifically for the exchange step.

Why the other options don't fit

• It is faster than symmetric key methods -- reversed: asymmetric operations such as RSA or elliptic-curve computations are markedly slower per byte than symmetric ciphers such as AES; that is precisely why systems switch to a symmetric key immediately after the exchange.

• Symmetric keys cannot be transmitted securely otherwise -- overstated: a symmetric key can also be delivered through an out-of-band channel, a hardware token, or a value pre-shared and stored offline before communication begins; the real reason is avoiding the need for any such prior secure channel, not an absolute impossibility of other methods.

• Public-key keys never expire -- factually incorrect: public-key certificates (e.g. X.509) carry an explicit validity period, and keys are periodically rotated or revoked as part of standard key-management practice.