Non-discoverability is useless.

If you want remote logins with encryption and don’t trust OpenSSH, just use telnet and restrict its access to only IPsec-encrypted packets.