What it does do well:

1. can validate a key signature issue

2. firewall port-knocking (extra http ports interleaved with instant ban ports)

3. ssh over https setup

4. IDS tripwire Morse-code knocking

5. reverse-proxy configuration for trusted zone ingress

This approach helps solve several issues:

i. distributed firewall probes or nuisance traffic

ii. brute force attempts or nuisance traffic

iii. obscures security posture identification (what got an IP blacklisted might have occurred several minutes ago)

Indeed, I also <3 autoexpect for quickly making monotonous tasks feasible.

Good luck =)