My notes on extending the Qubes OS Split GPG feature to include SSH Agent support:

https://ajmartinez.com/tech/posts/202121-003-split-ssh

Now my network-attached qubes no longer have any private keys on disk, and since my subkeys are also loaded on both of my Librem Keys as mentioned in an earlier post, I can still access my remote systems as long as I have one of my physical tokens.