Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas.