Just seeing this. Yeah, you're technically right. But I never sit at my headless boxes. I SSH to them and then from there could SSH Jump if I really needed to use SSH out of those boxes.

Also I wouldn't use Cloudflare Tunnels so this is a moot point.