[fnord77]

yeah, was going to say if you have access to the target user's `~/.ssh/config`, you have access to their keys.

Though I suppose if a key has a password on it, this attack might be useful.