I'm just saying that port knocking just results in another secret you have to manage. It's just adding another locked door. Why use a locked door that's a pain in the ass and insecure in transit?

If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?