> ... to my knowledge no general purpose clients give you feedback on this usage, so you won't know if this happened I'm afraid you're mistaken here. ssh-add(

> ... to my knowledge no general purpose clients give you feedback on this usage, so you won't know if this happened I'm afraid you're mistaken here. ssh-add(1) and ssh-askpass(1) support confirmation per-use: https://man.openbsd.org/ssh-add.1#c https://man.openbsd.org/ssh-add.1#c The agent I personally use — gpg-agent — also respects this protocol and asks me to confirm each use: https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html#index-sshcontrol https://www.gnupg.org/documentation/manuals/gnupg/Agent-Conf... Even if it did not, I can always configure gpg-agent to never cache the passphrase, thus making it ask me for the passphrase every time. This would also adequately serve as a means of confirmation, but thankfully this tedious option is not necessary, because of the above. > Prefer ProxyJump where applicable. I already do, but it's pretty orthogonal to agent-forwarding. The uses of agent-forwarding I mention in my original comment simply cannot be served by ProxyJump.