Or use port-knocking.

Thanks, i know what “public” means.
I don’t see “not usually installed on your system” as a strong enough disadvantage to PGP for this use case.

Wouldn’t that mean you’d have to share your public key anyway?
I have the same repos in multiple vms, keeping tabs of that key would be… interesting, considering i often use passwordless-logins across the board.

Try posting on mastodon with #fedihire, it’ll get boosted, maybe it’ll help.

What are your pain points and what do you prefer?

You answered yourself: ThinkPads. Beware of soldered RAM (and other "improvements) in newer models.