I really want a way to expose filesystem contents to someone via SSH without giving them the ability to execute arbitrary code. Bonus points for confining access to specific directories.
If you don't need scp, you could force the use of internal-sftp <https://serverfault.com/a/354618>.
[1] - https://serverfault.com/questions/836103/replace-scp-with-sf...