In many ways I think this blog post really makes quite compelling arguments and honestly opened my eyes a bit.
One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right.
One (perhaps mad) idea for more secure access to a machine deep behind many levels of NAT where you, the sysadmin, have lawful access but are fed up with having to have a 12 KB ~/.ssh/config file in order to access it because of your university's overbearing IT department^W^W^W^W network topology, would be to "just" run an onionsite with onion services authentication [1], preventing it being publicly accessed without the pre-shared key. If your onion service just redirects to ssh (presumably with certificate-only auth) I can't help but think that this is almost an example of security by obscurity done right.
[1] https://support.torproject.org/en-US/onionservices/client-au...