Why not use agent forwarding?

Where possible I do, of course, but some compute resources either don't allow to ssh in (e.g. k8s) or are configured to refuse ssh from anyone but root. I can become root on a jump box and ssh from there, but I lose agent forwarding in the process.