The interesting part to me is leveraging the ssh agent. Yes, the secrets are all behind yet another key, but it happens to be a key that doesn't leave your loc

The interesting part to me is leveraging the ssh agent. Yes, the secrets are all behind yet another key, but it happens to be a key that doesn't leave your local machine even when it's being used to get access to a remote secret, plus it's a key that you likely already have set up (and hopefully secured) for ssh access.