I love the idea of Single-Packet Authorization with fwknop instead of port knocking: http://www.cipherdyne.org/fwknop/

Nothing wrong with this, but a strong password for all Unix accounts (or, ideally, only allowing SSH with public key authentication) is essentially all you need. Unless you're using a dumb password, you're far more likely to be compromised by an application or OPSEC flaw (like someone getting into the email you used to register your server hosting account) than some crazy SSH compromise.

Curious, what specifically does nftables offer in this context that iptables doesn't ?

why nftables rather than iptables?

IP whitelist is tough when your home network has a dynamic IP.