Sure, a bad actor who knows the egress rules would naturally think of that. Maybe modify all authorized_keys with command=“sleep 3456”. I think a white-knight

Sure, a bad actor who knows the egress rules would naturally think of that. Maybe modify all authorized_keys with command=“sleep 3456”. I think a white-knight signal would be to rotate ssl keys, trying to intentionally expire the cert. Easy for anyone to grep in code. The problem is in-between.