restrict the generated key to port forwards to localhost:22 only.