Very interesting. A cool variant would be to, by default, offer the decoy shell on port 22 but also run the real SSH on port 22... But only activating it temp

Very interesting. A cool variant would be to, by default, offer the decoy shell on port 22 but also run the real SSH on port 22... But only activating it temporarily for the IP that just did succesfully port-knock. This should be trivial using some local redirection rules (so you'd run, say, SSH on port 19381 but use a transparent redirect to port 22 when an IP succesfully port-knocks in).