It's my experience that users will sprinkle an infrastructure with both public and private keys. While openssh allows for restricting public keys to a specific directory (which discourages them from generating lots of keys) it does NOT provide a similar mechanism for private keys (you can define a default, but not enforce its use).
In an ideal world, I'd want to be able to access hosts without entering a password or passphrase (apart from an initial passphrase for the ssh-agent).
Although the users at my $WORK start their ssh journeys with putty on MS-Windows I am only concerned with preventing them copying a usable private key to a machine which is acting as an ssh server.
These target hosts require the ability to make ssh connections elsewhere so I can't simply block outgoing ssh connections.
Short of implementing a full privileged access solution, is there a way I can let my users authenticate with key pairs but prevent them from copying their private keys (or generating their own keys and deploying either of the private/public keys)?