Is running untrusted programs in a VM actually safe? Are they sufficiently secure that it's not trivial to escape one if that's the expected scenario?
If someone's targetting you with a 0-day exploit that can escape VM sandboxing, having your ssh key hijacked is probably one of your lesser problems. :-/
(If someone has a VM-busting 0-day, they're probably using it in a targetted fashion. The wider that kind of thing is used, the quicker it will be noticed, and patched, and made useless.)