The safesh utility automatically creates one DSA key (called an identity) for each host you connect to, and stores this in a separate agent for each host. It is also capable of adding keys for other hosts to this agent, so you can use it for restricted forwarding of authentication. Because each host uses its own ssh-agent(1), the hosts you forward authentication to can only get at the authentication for the hosts you specifically say it should be able to get at.