SSH tunneling is not possible in PaaS environments.
I'm not giving up on SSH for CloudFoundry altogether, but Caldecott is an elegant solution that fits our constraints and solves one of our customers' problems.
The Stackato client supports this now as well.
http://www.activestate.com/blog/2011/12/new-stackato-client-...