Using ssh keys from Vault to ssh via Jenkins Pipeline - security

Question

I am trying to use ssh private keys stored in Hashicorp Vault to ssh to some servers in Jenkins Pipeline. I have the following code
stage('Syncing Scripts') {
steps {
script {
withVault([configuration: vaultConfiguration, vaultSecrets: vaultSecrets]) {
remoteCommands.copyLocalDirToServer(credentials, "server_files/*", "${username}#${host}", "~/server_path")
}
}
}
}
Library code for remoteCommands
void copyLocalDirToServer(String credentials, String localDir, String server, String remoteDir, int timeoutSec=10) {
sshagent(credentials : [credentials]) {
checkConnectivity(credentials, server, timeoutSec)
sh "scp -r ${localDir} ${server}:${remoteDir} "
}
}
username, host are two environemnt variable bound via Vault. credentials currently refers to an ssh key stored in Jenkins credentials. The Pipeline is working.
Vault is supposed to be the single source of truth. The ssh keys are stored in Vault and I am able to get them. But the problem is that I get a string from Vault in an environment variable. I am not sure how to pass that to the ssh command. Creating a file to pass to the ssh command puts the ssh keys in plain text on Jenkins which is not recommended.
To avoid this I had to duplicate the ssh keys in Jenkins credentials. I would like to avoid this duplication.
What is a possible solution to pass a secret ssh key fetched from a secret provider (like Vault) to ssh command running in Jenkins Pipeline that does not compromise on security best practices?