[sarciszewski]

At a glance, it appears that the non-ephemeral RSA signature is handled in the network, but the key exchange occurs at the endpoint.

What's new is the whole "edge calls home with a signing request" piece.