First the don’ts:

reference

And do this without using ssh-agent, that has a number of problematic security constructs (e.g. key forwarding).

Back in 2016 NIST issued a recommendation to:

When asked for a public key authorization an SSH client will, in its default configuration, try all the keys available to it. This means it will expose all the keys you might have to any server that ask. Here is how to fix it if you value your privacy, .