For the record, the third thing is to activate agent forwarding. In ~/.ssh/config:

Host git.mills.io
ForwardAgent yes

@movq@www.uninformativ.de This is how my SSH proxy setup works.

yhe sourde code is available so you can inspect it 😅