[Document] suggest confirming when using ssh-agent forwarding in readme

[gzm55]

ssh-agent confirm feature could reduce a little attack surface when have to forward the ssh-agent. For a one-time password and a dedicated ssh-agent forwarded via unix domain sock file (not -A option), if we can confirm on the signing, and a special ssh-askpass helper which can delete the private key after a single success signature, it should be considered as a way of transferring the confidential via ssh with very little attack surface.