How do you expect to get the nonce across the network without the NSA getting it?
I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.
If you're only able to passively intercept data (i.e. you can't impersonate the server and MITM) then you're unable to discover what the key established by DH is.
(incidentally nonces are generally only relevant for preventing replay attacks; the nonce doesn't play a part in passive defence)
It's the other way around. First you do the DH and then use RSA to authenticate (a hash of) DH parameters.