You can use read-only keys. Github has this, as do most other similar solutions. > Whatever vulnerabilities are introduced by agent forwarding they pale in co

You can use read-only keys. Github has this, as do most other similar solutions. > Whatever vulnerabilities are introduced by agent forwarding they pale in comparison to those you get by leaving your private key on the dev server. Not really. "pale in comparison" is way off. Leaving the key on the server, and using agent forwarding are almost the same: anyone with access to the server has access to the key. There's only a minor difference in how hard it is for the attacker to get the key.