On: SSH Agent Restriction (new in OpenSSH 8.9)

[misnome]

It looks like the dns name is just a convenience; it actually looks up the associated host key and uses that, not the hostname. So the attacker would have the private keys for the destination to make use of it; I think?