I always go in hard on agent forwarding because I don't think most people understand the limitations. If you look at my wording I said: "as if they had your pr

I always go in hard on agent forwarding because I don't think most people understand the limitations. If you look at my wording I said: "as if they had your private keys, because functionally speaking, they do" The remote hosts may not have the actual private key data, but they can operate as if they do. I will expand that section a little, but not at the expense of warning people off the feature. Thanks for the reminder about -W though, I meant to add that to the jump host section with a note that it's only available since OpenSSH 5.4. I apologise for tiring you, best of luck with your recovery :)