Response to 1:
Using a gateway you can already store all files on the private server, but until version 12.1.5 if you wanted to keep all user accounts on the private server then you could only authenticate them via password. From version 12.1.5, which will be released in early February (2020), you'll be able to authenticate users by public key as well. In other words, you'll be able to keep all files and users account on the private server and authenticate using a public key. The only key that you'll need to store in the DMZ is the DMZ server's own private key.
Response to 2:
Yes you can do that as well (in the current version, i.e. 12.1.4 and earlier)