Statically linked, but you can replace the entire application. You&#x27;d get one or two private key signa before the user disconnects and starts wondering what happened (remember that you need to have something to sign).<p>Of course, without askpass, a properly patched evil sshmuxd could sign a separate session while still signing ths original.<p>As I have said many times, ssh -W ProxyCommand makes you immune to evil jump hosts, but if root on a machine in your network got compromised, as would be required, then you&#x27;re going to have a bad day regardless.