Hacker News Reader

would cold-restarting sshd every hour also make this unlikely / harder to exploit?

not noticeably with the default config? you need to win a race that happens roughly every 120s

I guess you could restart every minute...