ssh-agent-filter-replace: new tool for in-place ssh-agent-filter manipulation
ssh-agent-filter-replace: repeated execution modifies filter

with these modifications, it is possible to repeatedly run
ssh-agent-filter-replace and have the filter replaced or removed, and it
will play together nicely with others who implement a reasonable
protocol.
visual logging of granted signatures

as with ssh-askpass, this defers the actual user interaction to an
external program, but in a more ad-hoc fashion. (notifyhelper will
always be specific to ssh-agent-filter, and might changes its arguments
to match the signature of notify).
notification: double-fork children

this allows waiting for the first child (for we can't just ignore child
signals), and the notify process itself can die in peace later without
becoming a zombie.
dissect pam-ssh-agent-auth's sudo details if present