I don't understand how OpenVPN/PKI is any better than running SSH externally on a different port and strictly using key based auth.
- Exposes less code to attack
- Can be run on a single machine, distinct from your production systems, where compromise will only result in a compromise of VPN communications, not of an actual production machine on which your production data/processes exist.
[1]: http://www.daemonology.net/blog/2012-08-30-protecting-sshd-u...