Agreed, I personally counter this by having different private keys for different networks and levels of security clearance. My work key gets me onto the work networks, once inside, I have a network specific key to use inside the network itself. This way I don't need to use ForwardAgent and my personal boxes will not be compromised if my work or any of my friends are.