In this type of setup, there is no need to store any private keys in the bastion host. When you login with SSH agent forwarding enabled to the bastion host, and from bastion host you try to connect to an instance in private subnet, the SSH agent will take care of authentication to the remote server with the private key stored on your laptop.
The SSH agent is a local program that keeps track of your private keys and associated passphrases, and it is the SSH agent that logs the user into the servers without having to keep typing passphrases again and again, especially if you have password protected private keys.
Agent forwarding is a way in which the SSH client allows the SSH server to utilize the local ...
