Yes, and yes. The pam module requires you to forward a remote connection to your ssh agent - when you connect to a compromised server your attacker can authent

Yes, and yes. The pam module requires you to forward a remote connection to your ssh agent - when you connect to a compromised server your attacker can authenticate to other machines as you. An ssh key for root is simpler and safer.