If you "click on a link" you won't type in your secret key (barring insecure ssh-agent set up) - but you might type in your password - for example sending it to

If you "click on a link" you won't type in your secret key (barring insecure ssh-agent set up) - but you might type in your password - for example sending it to a proxying ssh daemon despite a warning about changed host keys.