Revisiting my question, I now realize that Stefan’s original answer was all I needed. I just didn’t understand it at the time.
If you are using an SSH agent, libcurl knows how to get your credentials. But it can only do that if it knows your username for the remote system. I didn’t realize I could use the .netrc file to provide only a username, and not a password! Libcurl will get your username from the .netrc file and then look up your key with the SSH agent. It all works nicely when I have URLs with an scp:// protocol in my Artifacts.toml file.