Maybe I'm just asking for the correct search terms.
mod_nss and the NSS information/design idea is that if the key storage device (in this case, an HSM) is capable of performing a DH/SSL handshake, then the device will be used (the key is not extracted from the HSM, and then used on the host for the handshake, rather it is left on the HSM, and the HSM is used to perform the handshake). The idea is that if you are paranoid (or regulated) enough that you need to use an HSM, you won't want your keys extracted into the host, as that exposes them to compromise.
HSM managed handshake too slow
The issue is the duration of the handshake. Even without a PCIe, direct-attached HSM, the length of time needed for a single TLS handshake is measurable. If you are suddenly trying to use an HSM for the handshakes, you are limited by the PCIe bottleneck and all the overheads involved -- HSMs are generally built for security, not for high-performance.
The HSM becomes a bottleneck for services that support "enough" connections/second, "enough" being defined as "sufficient to swamp the HSM".
To trade off between the security of the HSM and the performance of host-based TLS hand-shakes (which can benefit from multiple cores, etc), we need to store the key on the HSM, but use the key on the host.
NSS' worldview prevents this.
Question: Can I extract the private key?
Can OpenSSL or other crypto suite, which can be connected to an HSM, extract the key from the HSM, and cache it for use on the host?
Plan B is to to get the (OpenSSL) OpenSC+OpenP11 engine or NSS source code, and hack it to extract and cache the private key on first request, and then just call back into openssl to do the actual TLS handshake rather than go out to the HSM for every new connection, allowing us to take advantage of the current (working) environment for https and ssh connections, while providing for security around the stored keys. But I'd rather take advantage of existing code.
Search engines just take me to the same pages, some relevant (the NSS design philosophy for example), some not. If you know of a good set of search terms that brings me to a page you know about :) that would be most help.
Thank you for your time.