If your jump box needs a private key file to connect (even if it's the same key as the one used for the private subnet instances), use this instead:
ansible_ssh_common_args: '-o ProxyCommand="ssh -i -W %h:%p -q user@gateway.example.com"'
I spent hours trying to fix a problem that now seems like a simple and obvious solution.
