Complete tangent to your original request, but I solved a similar problem by running dropbear sshd on a different port, with dropbear configured not to use PAM and pointed at a special /etc/passwd file that only lists the root user and with password logins disabled, so that the only way to use this ssh daemon is by connecting with a known private key. I use a locally-encrypted private key. Also the root user’s shell of this login is set to busybox’s sh, so none of the bash profile stuff runs and most shell commands run as builtins. Then, I set the oom priority of the dropbear sshd to the lowest possible value and give it high io and cpu scheduling priority.

This creates a really secure and resilient second method to access the server. It allows me to log in in the middle of a forkbomb, or log in after OOM killer trashed everything, and even sometimes log in when the root volume is dead and everything that touches disk gets permanently paused.