Why even type anything? Just ssh to 7000, and use the same public key to authenticate. The server responds with “You’re in”, opens up 22 and closes the connection. You then ssh normally.

This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy.

fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.