iiix

I don't know if I'd agree; with Unity you could just install a new DE & switch environments without fuss.

My biggest problem with Snap is that trying to install something like Chromium via apt, will, most likely unbeknownst to the user, just install the Snap version instead.

You could try using Tailscale. It's a wireguard based mesh VPN. Just set it up on your device, your server, and you're good to go. You can just only allow SSH over Tailscale, without worrying about anybody else trying to get in.

Other alternatives include ZeroTier and Nebula afaik, but I've never tried either.

(Still use SSH keys regardless though.)