I'm not aware of any agents that allow for the selective forwarding of keys as you've diagramed. Once a key is forwarded to a host, it's as if it were locally stored and can be used to authenticate against any host from there.
Looking at your question on another level, I have two ideas about what you might be trying to do:
- Prevent somebody from authenticating to certain hosts without physical presence at a location.
If this is your goal, you cannot achieve it through control of authentication keys. You must control access through architecture and host restrictions such that no host which can be accessed remotely is capable of accessing a "safe" host.
- "Protect" certain keys so they're not exposed.
If this is your goal, it's a misunderstanding of how to protect keys. Keys themselves are never forwarded. The ability to access the ssh agent to authenticate against a key is forwarded. However, that forwarding can only be taken advantage of while the forwarding is in place and only if the machine you've forwarded your agent to is run by an untrustworthy admin (voluntarily or through compromise). Thus in your diagram, unless you successfully log from machine B -> D and export forwarding from A -> B -> D, you are not at risk of exposing your credentials. You can forward from A -> B safely if you trust B.
I suggest you read a very verbose explanation of how forwarding works with diagrams if you're still unclear about the concept.