Hacker News Reader

Though true in most cases you can then add your own authorized_keys entry.

That does not compromise the user’s SSH key, though, “only” (and potentially persistently as you say) one or more target servers.