The key is in the name: agent-forwarding. ssh doesn't pass the key itself through to onward connections, it passes a connection to your local ssh-agent instead.

The key is in the name: agent-forwarding. ssh doesn't pass the key itself through to onward connections, it passes a connection to your local ssh-agent instead. ssh (the command) can access the material in your private keys in one of two ways, either by direct file access itself (in which case it will always ask you for a passphrase if there is one protecting the key in question), or else via an intermediating ssh-agent process. Roughly speaking, ssh does something like the following when looking for key material: if private key file exists and has no passphrase on it use it directly (and implicitly do not forward the agent) else if ssh-agent is running ask the agent for the key (and forward the agent) else ask the user for a passphrase ourselves (and implicitly do not forward the agent) end The end result of all this is that if you have an unprotected key, ssh doesn't talk to your local agent at all, and so obviously can't forward it.