Every "jump host" I've seen in the past 25+ years has used SSH externally.