This would appear to be an absolutely classic case for using agent forwarding.

The TCP forwarding method is a little more resistant to interception on the intermediate hosts by someone with root privs, but this is pretty marginal in most situations.

Personally I would (and do, frequently) use a chain of ssh with agent forwarding to get this effect.