Sounds like a lot of additional work and resources for no real gain. Its like trying to waste the time of spam callers, their time is infinitely cheaper than yours, its a waste of resources to engage in any capacity.
I think it sounds like fun, so that's something.
Some cool ideas. But do you have actual numbers by any chance? Like, wp login attempts per month, ssh connects etc. Just curious, what actually worked and how the measures compare
I've looked at how to characterize the ssh tarpitting, and I'm not sure how to do it. I haven't put serious thought into characterizing WordPress logins at all.