Filter SSH agent at Proxy?

Question

I have two SSH keys on my local PC - one to access my bastion and one to access my private server, behind the bastion.

As per Scp over a proxy with one command from local machine?, I can provide a single proxy command to provide seemless access to my private server from my local PC:

Host bastion
    <bastion connection details as per usual>

Host private
    ProxyCommand ssh bastion -W %h:%p
    <private connection details as per usual>

The works great, but it exposes a security hole if I'm using Agent Forwarding to authenticate - Both my Bastion and Private server keys are forwarded to the Private server.

This is obviously not ideal - the Bastion private key has no place being available once we've proxy'd through it.

The only way around this I've found is to abandon the ProxyCommand and use a 2 step ssh like so, extending the direct Host section for the bastion itself. This assumes a further config file on the bastion to define host private from there.

Host bastion private
    <bastion connection details as per usual>

Host private
    RequestTTY force
    RemoteCommand afssh -c /path/to/private/key -- private

I don't think there is anything wrong with this from a security point of view, but it's a bit clunky, and doesn't work for scp for example, so I was wondering if there is a better way of doing this?

You may think I could just call afssh from the local PC, but given it's a wrapper around SSH, this filters out the bastion key before starting the proxy connection and thus prompts for the passphrase on execution of the ProxyCommand which is even more clunky.

Thanks for any advice!