nblr

Fail2ban? sshguard? unnecessary. Just disable ssh passwd auth (which generally is a good idea) -> done/done

If you don't like lognoise from ssh scanners (even if you disable passwd auth), move your sshd port to some random high port and make note of it in your ~/.ssh/config

Generally: if in doubt, take the more simple and elegant solution to a problem.

Binary client. Uhm. Yeah... nope. Wasn't StartSSL (haha. SSL) the CA that also offered to create the key on your behalf? Sketchy!