The goal
Be prompted for your SSH key passphrase on first use, have it remembered for ~10 minutes, then forgotten. Caching for the whole session (the Windows default) was the thing you wanted to avoid for security.
Why it was hard
The built-in Windows OpenSSH ssh-agent simply cannot expire keys. We proved this empirically:
- ssh-add -t 600 → "agent refused operation"
- AddKeysToAgent 600 in ssh config → silently refused, key never stored