The advantage that OpenSSH have here is that they don't have to just hide the signal using noise, they can actually change the signal to look like the noise (or

The advantage that OpenSSH have here is that they don't have to just hide the signal using noise, they can actually change the signal to look like the noise (or vice versa). For example they are making the signal packets some at a regular interval (since the "signal" being discussed is the timings). That alone would not hide the number of keypresses, but adding the chaff should do so. In this case, as said above, it seems like there's an implementation issue with actually doing those obfuscations, allowing the signal to be identified.