According to the page, you can run your own SSH proxy if you don't want to use theirs. The way it is described suggests that the bastion doesn't have clear-tex

According to the page, you can run your own SSH proxy if you don't want to use theirs. The way it is described suggests that the bastion doesn't have clear-text access. It shows that the SSH session is forwarded, versus having 2 distinct SSH sessions, so I hope that's right.