sc_get_keys loads the public keys from every certificate stored
on the smartcard. Therefore public keys of CA certificate (or other
certs for which there's no corresponding private key on the smartcard)
are loaded into the ssh-agent. This has (at least) two drawbacks:
a) loading certificates from a smartcard is slow and
b) the useless public keys might confuse the user (which keys of the
   'ssh-add -L' output are actually usable in .ssh/authorized_keys).

Regards,
Nils