+1. I put the tool on my TODO list of things to look into.

When you get that time, I've also opened the following PR that includes a proof-of-concept test

https://src.fedoraproject.org/rpms/openssh/pull-request/73

It's sloppy at the moment.  The GEF extension should probably be packaged and not bundled in the test.  If this is an interesting approach it should probably be a shared test instead, and used in various other packages that commonly listed on network ports.  But I think this at least illustrates what I'm suggesting.