well -- IIRC we had discussion on this one... and apparently it was never finalized

quick note for now: if it is not directly related to failed authentication i.e. might be triggered by other reasons (e.g. flaky connection), it might be a better fit for sshd-ddos  or some other filter/jail