Microsoft remoteapp

We are looking into load balancing and SSL offloading our remoteapp farm. Right now we have a connection broker that is hosting the Web part and then connects to the app farm.

My understanding is that I have to create the web part/connection broker as one pool, then have the app hosts as another pool? I've looked through some of the deployment guides and this still confuses me a little but I can probably figure it out.

My biggest question is this. Right now in our deployment we have to buy a certificate for each of the servers. So if we have a web/connection broker and then 4 app hosts we have to buy the cert to put on each server so that gets expensive. Can the F5 offload the SSL on the remoteapps like it can with IIS? That way we only have one certificate for all of the servers?