Tailscale is a lot of permanent runtime overhead/latency just to avoid setting up dynamic DNS and changing a few lines in the sshd_config.

Do you have recommended reading? I haven't been confident enough that I wouldn't overlook serious security issues opening SSH on my own machines.