hhii

In our team, we always use an ssh-agent, and require it to confirm, via popup, each use:

https://en.wikipedia.org/wiki/Ssh-agent#Security_issues

> There is a procedure that may prevent malware from using the ssh-agent socket. If the ssh-add -c option is set when the keys are imported into the ssh-agent, then the agent requests a confirmation from the user using the program specified by the SSH_ASKPASS environment variable, whenever ssh tries to connect.