Out of band could be as simple as ngrok, or cloudflare Argo - or as you suggest by a separate connection.
SSH is two factor - key + password and Argo,ngrok,wireguard to a VPS provide DDoS mitigation and attack surface concealment and reduction.
I think I’m missing what your product adds.