[momentoftop]

Just my understanding of the manpage and TCP forwarding (-L): an SSH connection will be established to the jump host, which then establishes a connection on port 22 to the destination. The local machine now has a forwarded connection to the destination and uses that to establish a second SSH connection between them.

Between local and jump host, there will be two layers of encryption. The jump host decrypts the outer layer, and the two ends the inner layer.