Why is everyone just authoritatively dismissing this, when this has been supported for >7 years and is easily found with a google search?

There is the HostKeyAgent configuration directive, which communicates over a unix domain socket to make signing requests.

https://framkant.org/2017/10/strong-authentication-openssh-h...

https://github.com/openssh/openssh-portable/blob/12492c0abf1...