More and more evidence seems to be surfacing that the Heartbleed vulnerability leaks the private key portion of the SSL certificate in use.
As such this can actually mean that if an attacker was also able to passively monitor SSL traffic, when they get hold of this key, they could decrypt an unlimited log of SSL data, potentially accessing thousands of user's sensitive data.
But I had thought that such implementations as Perfect Forward Secrecy were supposed to defend against this by utilising a symmetric key that meant the revealing of the SSL private key would still be insufficient to decrypt recorded SSL traffic?
How widespread is the use of Perfect Forward Secrecy and if not-so, is this trivial to setup in an HTTPS context?