It also seems to me to have an awful lot of security-sensitive code in the critical path that is not needed for this use case. Granted, a break in OpenSSH will

It also seems to me to have an awful lot of security-sensitive code in the critical path that is not needed for this use case. Granted, a break in OpenSSH will get a lot of attention, but if we're operating at a level of paranoia where this is a relevant part of securing a system, that seems like the bad kind of overkill.