Even better, if possible switch to something like PGP keys on Yubikey which prevents exfiltration of the private key, and will only sign things when you enter PIN / touch the device.
Worked smoothly on most systems.
Kind of messy on Windows, because there are so many SSH agent implementations, but GPG4Win's latest version works with the native SSH now. Real progress.
And that’s completely separate to the PIV functionality on the key.
Don’t forget this diagram of all the agents, protocols and bridges you might hit on Windows.
It should be a prime example of what NOT to do.