yes, but wireguard is undetectable because the server won't reply to packets that fail auth whereas sshd will respond (with a banner!) to anyone who comes knock

yes, but wireguard is undetectable because the server won't reply to packets that fail auth whereas sshd will respond (with a banner!) to anyone who comes knocking stealth is basically impossible with TCP