I'm not entirely familiar with sub-CA specifics, but CloudFlare (at the very least) has developed a system for deploying SSL with off-site private keys[0]; I imagine that could be used in a situation like this.

[0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...