You can use SSH agent forwarding, however that causes some holes to open up as well, so ymmv.
# Sample bastion host configuration without ForwardAgent
# Host bastion
# User bastion_user
# Hostname 10.11.12.13
# IdentityFile ~/.ssh/id_bastion
#
# Host server
# User server_user
# Hostname 192.168.0.1
# IdentityFile ~/.ssh/id_server
# ProxyCommand ssh -q -W %h:%p bastion