OpenSSH 5.6 released

ControlMaster and ControlPersist *can* be a security problem, but not for the reason you state. Because connection (using a given key: you can use several keys with the same master) is only done once, you only have to type in the passphrase once. So if you leave a ControlMaster hanging around, it's got exactly the same security implications as leaving an ssh-agent hanging around. However, unlike agents, you can tell the ControlMaster to die after a time (via e.g. 'ControlPersist 500' to die in 500s). I can think of several hosts where I'm about to switch entirely from agents to ControlPersist as a result.