The approach is pretty obvious, and I instantly knew where they were going as soon as I read the phrase "session signing, the only part of the SSL handshake that requires the private key", but still, it's novel to take this existing concept and generalize it to solve the "I don't want to give CloudFlare my private keys" problem. It'll be especially cool if they establish an open standard for the keyserver protocol.