Shrug, given how hostile the internet is I fail to see how this increases the risk at all.

Yeah, I am not so sure how knowing that keys are rotated helps the wannabe attacker. The only "useful" bit would be to look for SSH port up in the range, not much help though.

My attitude is short of you having the SSH keys if I can't tell my entire setup and still be secure then I'm relying on obscurity not security.

If you do it right it doesn't matter.

The default ip(6)tables rule: drop all packets

For example to access my least secured public facing server you need to do the following: 17 port port-knocking to enable crypto port knocking Which enables ssh Which requires a 16K RSA key and TOTP The only accounts that can be logged in have 18 character randomly generated usernames and 255 character passwords. The login accounts have no access to administrative functions. So you'll need to su to an administrative account and guess the 255 character password or have a zero day exploit that can bypass SELinux and cryptographically signed white-listing of binaries.