Nothing that complicated is required. When the server needs to sign the DH handshake, it sends the value to be signed over to the key server, and the key serve

Nothing that complicated is required. When the server needs to sign the DH handshake, it sends the value to be signed over to the key server, and the key server replies with the signature. Although the diagrams in the blog post show the non-PFS RSA handshake, I'm sure the architecture already supports the PFS DH handshake too.