[fhqghds]

Note that GP said -A -- this means the agent gets forwarded, and processes on the malicious server can ask the agent to perform authentication operations.

Touch to auth means the agent (or hardware token) asks the user to to confirm they are expecting an authentication request to come in.

This allows you to forward your agent to a host and have slightly more protection against malicious processes on the host using your key.

[cma]

Github shouldn't ever make any use of -A should it?

[xmodem]

Nope. But if you -A to a malicious server it could use your key to push to github.