That's a good point about master keys. The state is pretty bad with Apache for example, and I'm not sure its much better with nginx at least by default.

I think that what he means is that you terminate SSL on the load balancers (= single termination endpoint), then have your cluster beneath it (non-SSL/TLS, or new SSL/TLS connection, thus different tickets)