As far as I can tell, to do proper ssh-agent forwarding, you need to use the paramiko.agent.AgentRequestHandler API. Also as far as I can tell, it's not documented.
I checked Paramiko's docs, but could not figure out how to do ssh-agent forwarding. I ended up finding out how by reading pull requests/bugs for ssh-agent forwarding features in frameworks that use Paramiko under the covers, like fabric and ansible.
I wrote a gist about what I found and how I use the API.
This API should be documented.
Thanks for this! Will review & append when I get to the next bugfix milestone.
Changelog closes #516