Tried that. I got it to work, but it's super hackish and brittle. Basically, Github supports deployment keys, but they need to be unique per repo, so if I have many repos I want to clone (for each private npm module) I will need to clone multiple keys. Then since ssh only allows different keys based on the hostname or username, and all git clones are git@github.com, you have to create a script for the GIT_SSH env var to choose the right key based on the value of $2 passed to the GIT_SSH script. The only way a deployment key makes sense is to make a dummy user with read only access to the repos you need, which is yet another undesirable hack.
Turns out what I want to do is impossible without something like spiped. I dug into the source of the cli tool and it looks like it doesn't rely on ssh at all. Instead it does all the provisioning through amazon APIs. i.e. Amazon is sshing into the machine for provisioning purposes, not my machine.
Basically, I need to expose my ssh-agent socket to the world via a TCP socket exposed to the world. The server would then install spiped, get the symmetric key that allows it to connect to my ssh-agent-port and set up the SSH_AUTH_SOCK to proxy requests to my machine.
This is still more secure than ever letting your private key ever leave your machine.
While I don't think I need it anymore since I can mount the unix domain socket anywhere, I did find this script useful and think others here may as well:
