Seems fairly good - I would consider going 25519-only if you have compatible clients for kex and auth. Some of their concerns with SSH agent forwarding are goo

Seems fairly good - I would consider going 25519-only if you have compatible clients for kex and auth. Some of their concerns with SSH agent forwarding are good too - but make me wonder if writing some little GUI that would have you allow or deny authentication requests would solve the problem.