As you probably know, the agent is defined via environment variables, so you're right the same inconvenience would exist. BTW, have you looked into configuring

As you probably know, the agent is defined via environment variables, so you're right the same inconvenience would exist. BTW, have you looked into configuring different per-host (or per-environment) credentials via `~/.ssh/config`? Agent forwarding in general is often seen as a weak mechanism to propagate trust and from Teleport's team perspective it's a backward compatibility feature. Speaking generally, Teleport solves the similar problem (trust propagation and role based access control for SSH) by not using public keys at all, and instead issuing role-based certificates, i.e. enforcing corporate policies like "developers must never touch production data" or cross-organizational policies like "these contractors can only touch this sandbox).