SSH agent forwarding is a footgun. Use ProxyJump instead.

You need to git pull on a server, or hop from a bastion to a box behind it, and your key only lives...