I just realized that I need SSH agent forwarding in order to push to one Git server that then forwards the commits to Github.com. I never used SSH agent forwarding and don't understand the security implications of enabling this feature. Do I have to trust the remote server in order to allow SSH agent forwarding to it?
Yes, you have to trust the remote server if you allow agent forwarding for this server (especially if you use the same key for more services). Doing so rogue root or evil admin with root access can impersonate you for authentication to other servers during the time you are connected to that server.
The state is still better than accessing the key permanently or stealing it from you, what could happen when you would copy your private key to the server, but this is still an issue, since there is no confirmation on your side, that you really want to do crypto with your key in agent.
Using separate key for github is probably good idea. And having middle-step-clone of your important repository on a server you don't trust is probably something you also don't want.