standalone rsync and ssh work, but drush gets me a "Permission denied (publickey)"
You are not specifying a remote-user on @bak so who are you performing operations as on the server at @bak? You are also not specifying any ssh config options. In this case, you are asking @bak to authenticate with @prod via ssh/rsync but you are not using agent forwarding so @prod can't see your private key. Try specifying something like

'remote-user' =&gt; 'user_on_bak',
'ssh-options' =&gt; '-T',


So that drush will execute as 'user_on_bak' and ssh will pass along your local key to @bak so when it opens a session with @prod it will have a key to pass along.