My understanding is slightly different:
* ECDH is PFS also unless someone is able to get a memory dump of the live running server. If you restart the server, even with ECDH, there is no way to break PFS when the attacker gets your private key.
* With ECDHE (activated by `OP_SINGLE_ECDH_USE`), an attacker that gets a memory dump of the live server will only be able to break sessions that are still active (not old ones).
* A third approach would be to regenerate key material for ECDH every so and so many seconds in the live running server. Essentially, `OP_ECDH_REUSE_TIMEOUT` - which isn't available, but could be implemented in pure Python. This reduces the additional computational load induced by "single use", while still being "more secure" than reuse for whole server uptime.
* Nevertheless the doc string is misleading, since the curve set by the function is used for both ECDH and ECDHE.