When I do something like this:

withCredentials([sshUserPrivateKey(credentialsId: 'foo', keyFileVariable: 'SSH_KEYFILE')]) {
  withEnv(["GIT_SSH_COMMAND=ssh -i ${SSH_KEYFILE}"]) {
    // a step that requires GIT_SSH_COMMAND to be set
  }
}

I get a warning that a secret as passed to withEnv using string interpolation. That’s not true: the contents of the key file are secret, but the thing I passed to withEnv—its name—is not.