Add a TLS auth channel to the portknock with a wait window and OTP and you are really in business with this approach.