SSH agent forwarding via
ssh -A does NOT store the (unencrypted) private key on the remote system. Rather it sets up a socket on the remote system that is tunneled back through the open ssh session to the user's running
ssh-agent on the origin host. The location of the socket on the remote end will be stored in the value of the environment variable
SSH_AUTH_SOCK and will likely be something like:
Therefore, you won't be able to do what you want using agent forwarding in the simple case, but unless your origin host is going to go offline entirely (e.g. your laptop), you could leave a connection open solely for the purpose of
ssh-agent forwarding. Something like this:
ssh -fTA REMOTE "sleep infinity"
(aside: I tried that with
ssh -fNTA ..., but it wouldn't create the remote agent socket, even though I use that when forwarding ports with success - dunno why yet).
CAVEAT: inherent to the design of agent forwarding, anyone with
root privileges on the remote system will be able to read your unencrypted private keys out of your agent on your local/origin system through the socket. It's a risk, but not a deal-breaker, and certainly better than encoding passwords in files.