However I'd wish the reverse is true, SSH via TLS connections, so I don't need to open another 22 port, and make my SSH hidden behind Cloudflare or something.

Making ssh authentication dependent on honesty seems like a really bad idea.