If the jumpserver is trusted and controlled by you then you should have a look at ssh agent forwarding. Then you avoid leaving keys on the jumphost.
Edit: To add some details - using ProxyJump you don’t have to expose anything to the jump host and instead just proxy through it.