For VMs, I find RDP to be on par with SPICE (which is more of a qemu/libvirt thing). Both have support for device/drive mapping, I believe. That's both over ssh sessions (I know RDP has encryption, but I'd rather not trust it).