add strictHostKeyCecking settings for ssh-tunnels. refactor copy*From so they all use a tunnel, if necessary