It's not technically necessary for a TLS web server to have unfettered access to the private key. The web server could offload the signing operations to a separ

It's not technically necessary for a TLS web server to have unfettered access to the private key. The web server could offload the signing operations to a separate server under the control of the attacker. The web server only has access to premaster and session keys. CloudFlare calls this Keyless SSL. This would make the attack quite complex, though. It's more likely that the malware will just use the new key for a few hours and then delete it and scrub the disk, which will be enough for the majority of production deployments.