It would seem to me that this is insecure - any site I trust with nefarious intention [or that is hacked] could take my private key when I connect the first time, and use it to go into the other sites.
Can someone who understands SSH verify that its safe to use one key pair everywhere, and if so, perhaps explain why?
Public keys work based on challenge authentication. Basically, you give several sites your public key, so each site can issue a challenge to you. This challenge is unique every time and can only be answered by a person with a private key.
A simplified example would be if the server takes your public key and encrypts a message like "The session key for user X at Dec 19th 16:30:03.351213 UTC is XPa7sK35WjMgAezrPmG1Sq4CV7nsFN1Uc3TRW6P8Evc". Your client computer receives the encrypted message, decrypts it with your private key, and then sends back the decrypted session key to the server, validating that you have the private key in your possession upon which the server authenticates you. (In practice its often more complicated with the server typically has public/private host keys, so you can encrypt your messages to the server and authenticate that the server is who it says it is).
Having your public key doesn't give a malicious server extra methods of attack with the exception of trying to factor the modulus from your public key to recreate your private key. This is only possible if your key is too small, that is 512-bit keys were cracked a decade ago, 768-bit RSA keys were reported cracked last year (with about 10^20 operations; or 2000 years on a single core of a modern processor); 1024-bit keys are still safe, and the ssh default is 2048-bit keys.
