Genuinely curious, how would you block an attacker from getting to your SSH port without knowing the path you will connect from (which is the case for remote access) at configuration time? I don‘t see how Path-Aware Networking would replace a VPN solution

The SCION Book goes over a lot of potential solutions that are possible because of the architecture, but my favorite is hidden paths. https://scion.docs.anapaya.net/en/latest/hidden-paths.html

> Hidden path communication enables the hiding of specific path segments, i.e. certain path segments are only available for authorized ASes. In the common case, path segments are publicly available to any network entity. They are fetched from the control service and used to construct forwarding paths.