To bin/remote deploy hosts, you currently need a deploy.key locally which is privileged. This key should be picked up by bin/remote on the bastion instead.

This is sort of involved because no other commands currently pick up data on the bastion -- they don't need to, since keystores are available locally once bin/remote deploy checks out repositories.

The bin/bastion command probably needs a new deploy-key sort of workflow, and then bin/remote deploy needs to run bin/bastion deploy-key --host host instead of bin/bastion ssh --host host ....