I found out that I can use the "--ssh" argument for this:
% xpra --ssh 'ssh outer ssh' attach ssh:inner:7

It would be useful though, if xpra would transform this automatically out of 
"outer:inner".

Right, that's the workaround I would have suggested :-) But I imagine that this 
comes up relatively often, so that's a good idea to provide a nice syntax.

(Also, FYI, depending on your setup, you might want to consider just running 
xpra on 'outer', and then using X forwarding from 'inner' to 'outer' -- that's 
what I do when running stuff on our compute cluster, that has one 'bastion' 
host where I run screen+xpra and then a bunch of hosts with fast network 
connections that I can ssh onwards to.)

I guess you could also do (--ssh is a 'new' flag, so this is required for older 
version):
xpra --remote-xpra 'ssh inner .xpra/run-xpra' attach ssh:outer:7

and/or setup a .ssh/config entry for inner that sets ProxyCommand "ssh outer -W 
%h"

Like suggested in comment #4, this functionality can be achieved with 
ProxyCommand option for openssh.

Let say you're able to connect to host outer.host.example.com with public key 
authentication and from there to inner.host.example.com also with public key 
authentication (key is loaded in ssh-agent and agent connection is forwarded).

Then by configuring following entry in $HOME/.ssh/config ...


host outer-inner 
                hostname inner.host.example.com
                compression yes
                protocol 2
                ProxyCommand ssh outer.host.example.com "/bin/nc %h %p"
                ForwardAgent yes

... will allow you to ssh to inner host in one step ...

  ssh outer-inner

... or use xpra from your client as ...

  xpra attach ssh:outer-inner:DISPLAY_NUMBER

It works perfectly for me.