The ssh-agents script does not properly detect keys that are encrypted using more recent versions of OpenSSH, since the header of a private key no longer needs to specify encryption information. This means that ssh-add is executed for those encrypted keys, prompting for passwords.
References:
- https://security.stackexchange.com/a/129729/153547