But... this doesn't work for SSH, which is the problem here?

SSH has ProxyCommand which accepts the %h template.

Provided your users will configure something a little - or you provide a wrapping command - you can setup the tunneling for them.