Спойлер:
===========
Коллеги — я вам наврал!
ответ на вопрос — нет, ключи не едут по сети на промежуточные хосты. The agent will never send a private key over its request channel. Instead, operations that require a private key will be performed by the agent, and the result will be returned to the requester. This way, private keys are not exposed to clients using the agent.
===========


SSH_AUTH_SOCK
ssh-add
# ssh-agent support
if ps -xo command|grep -q ’^ssh-agent’
then
. ~/.ssh/ssh-agent—s
else
ssh-agent -s >~/.ssh/ssh-agent—s
. ~/.ssh/ssh-agent—s
ssh-add
for idF in `ls ~/.ssh/*.pk 2>/dev/null` `ls ~/.ec2/*.pk 2>/dev/null`
do
ssh-add «$idF»
done
fi
##

eval `ssh-agent -s`

SSH_AUTH_SOCK=/var/folders/q4/lzrhxrs10kbf8typz4209d080000gn/T//ssh-aMHglgqNsfA3/agent.394; export SSH_AUTH_SOCK;
SSH_AGENT_PID=395; export SSH_AGENT_PID;
echo Agent pid 395;

SSH_AUTH_SOCK=/tmp/ssh-bNQbWc6968/agent.6968

sudo tee /etc/profile.d/ssh_auth_sock.sh