Seems like a wireguard port in would be a simpler solution, at least superficially. If somebody manages to break both wireguard and ssh security, they probably had access to my laptop anyway so I've lost already.