Locking your ssh-agent exposed local-only keys until OpenSSH 10.5

Lock your ssh-agent and it should sit there refusing to sign anything until you unlock it. In OpenSSH 10.