An easier, more secure approach, would be

    authviassh://authviassh@auth.server/origin.domain/nonce

parsed restrictively

    authviassh:\/\/authviassh@(${domain_regex})/(${domain_regex})/([0-9a-zA-Z]+)

prompting the user:

    "Would you like to log into origin.domain (via auth.server) using ~/.ssh/your_key?"

and then finally running

    ssh "authviassh@auth.server" -- authviassh "origin.domain" "nonce"

with the appropriate additional flags to turn off forwarding et al

Only problem is, only 1 language has decent bindings for ssh interactives server-side, so one is somewhat forced to learn Go to implement this easily