I’d rather go with custom initramfs plus zfsbootmenu.

Can make it even a bit better by only letting ssh listen on a wireguard tunnel.

BOOM