Great point - port knocking would have provided a separate line of defense when that horrible Debian/Ubuntu keygen flaw hit a few years back.