sshfp would be my recommendation there. https://en.wikipedia.org/wiki/SSHFP_record unless I’m misunderstanding what you’re asking exactly regarding the server fingerprint. Shunting it to dns seems the best option.

As to the article, I block by country, and have a rate limiter and also just setup a cronjob of the following to scan my authlogs and add to the same rate limited bruteforcers pf table. (I expire entries after a month or so just to keep memory usage down).

Yeah yeah I know there are things that do this, this took all of 5 minutes to program and only a bit more to debug.

#!/usr/bin/env sh
set -e
grep -Ev '(10.10.10|0.0.0.0|mitch|Accepted|disconnected by user)' /var/log/authlog | perl -ne 'if ($_ =~ m/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/) { print $& . "\n"; }' | sort -u | xargs -n 2000 pfctl -t bruteforce -T add

for x in $(pfctl -t bruteforce -T show | grep 10.10.10); do
  pfctl -t bruteforce -T delete ${x}
done
pfctl -t bruteforce -T delete $(ifconfig em0| grep inet | grep -Ev prefixlen| awk '{print $2}')

Its not pretty but it works, and means I can keep ssh on its normal port. I only allow ssh keys anyway so its not like its doing much more than keeping my logs clean really. Theres a few things i could improve too like the grep | grep by throwing it all into awk but eh, its such a minor nit i don’t care much. The last bits are there just in case anything on my internal subnet or the host itself ever found itself on the blocked table. YMMV this is mostly just a log cleaner more than anything.