Saw this yesterday, then vanished.

I'm re-submitting as this explained to me an important subject in simple terms.

However, my own personal takeaway is that the security fail is actually in ssh-agent. It automates access to your key.