Because of the risks of agent forwarding it is nice to see sensible mitigations from the OpenSSH team.