I guess what this comment says (ping @dottedmag ) is that we authorise ```user@ip```, but user is the user running locally. Nobody guarantees that the remote end will connect using that username.