I share the concern about security through obscurity. But this isn't intended to be obscure (it's not like I change the port to 12222 and hope no one finds it). It's a technique like port knocking which relies on the algorithm being totally open but the underlying hash being unpredictable. All the security here comes from the passphrase + hashing combination which is designed to make the actual port difficult to determine.

John