Simultaneous Setup-Hold Critical Node

I've got this question multiple times- How do we fix timing violations on paths that have at least one node which is both setup critical and hold critical simultaneously. To answer that question, one must realize that (generally speaking) for the same PVT and same RC corner, there cannot be paths where all nodes are simultaneously setup and hold critical. 

Let's take an example:

Test Case

Now, if we buffer at node C, path from B to C which was already setup critical will start violating.

Buffering at C

If we buffer at Node A, the path from A to D which was already setup critical would start violating.

What shall we do here now? Any suggestions? Thoughts? I'd like to hear from you and I'll post the right answer (at least one of the right answers soon!). Just like always, looking forward to engage in the comments section below. 

The Timing Optimization Problem

Puzzle:

Tomorrow is the scheduled tape-out of your SoC. The target clock frequency for this SoC is 100 MHz (Time Period of 10 ns). However, there's only one setup violating path and you need to fix the timing by doing ECOs. Area is not a constraint.

Here's the circuit:

Points to note:

• My tape-out is tomorrow, I don't have the liberty of asking the RTL design team to change the architecture of the design.
• I have used the highest possible drive strength cells, and perhaps the lowest Vt flavor cells available in my standard cell library.
• There's no redundant logic in the path, it's been optimized well.
• I cannot add delay to the clock path of FF2 because doing so, the hold time of the scan chain connecting flops FF1 and FF2 would fail.

Please suggest ways to solve this timing violation. A rough image would be really helpful. I shall post my solution in a couple of days time.

Mike posted the correct answer, and I'll just add a figure explaining the solution: