Mmm... Blowfish...
After looking for ages, I've recently found SSHKeychain, an Aqua-integrated ssh-agent thaat works the way I want it to. Other agents have done the job adequately, but SSHKeychain has a bunch of little features that make it stand out from the crowd. It'll run in the menubar (so it doesn't take up space in the dock), but more importantly it makes use of the Keychain. Not only can you store your passphrases in there, but the agent can forget keys when the machine sleeps, and ask you for the (Keychain) passphrase on wake, or the next time the agent is accessed.
Now I just need to get round to sorting out an on-demand wrapper for SSH tunnels...