safesh
The safesh utility automatically creates one DSA key (called an identity) for each host you connect to, and stores this in a separate agent for each host. It is also capable of adding keys for other hosts to this agent, so you can use it for restricted forwarding of authentication. Because each host uses its own ssh-agent(1), the hosts you forward authentication to can only get at the authentication for the hosts you specifically say it should be able to get at.
Appears to be FreeBSD specific but it can't be that hard to port if you're in to that kind of thing.