The suggestion floated in many comments here to create extra keypairs on remote hosts for access to other remotes from the former is a terrible idea. Resident

The suggestion floated in many comments here to create extra keypairs on remote hosts for access to other remotes from the former is a terrible idea. Resident private keys on a compromised machine can be exfiltrated. Even if they're passphrase protected, using them requires them to be decrypted on the machine they're resident on. `ssh-agent` is not the only SSH Agent. There exist SSH Agent implementations that are secure. E.g., gpg-agent. Use one of those, with the `ssh-add -c` flag or equivalent, and you get both security and convenience.