Instead of forwarding the ssh agent I use a bastion host and proxycommand. That lets me keep the ssh private key on the outermost host. The outer system has t

Instead of forwarding the ssh agent I use a bastion host and proxycommand. That lets me keep the ssh private key on the outermost host. The outer system has the key, and the inner bastion system has the acl to connect inward to actual servers. Works well.