For the record, the third thing is to activate agent forwarding. In ~/.ssh/config:

Host git.mills.io
ForwardAgent yes