I have a few SSH tunnels going here and there and found that a nice segue into the systemd hardening realm.
And so the somewhat dated systemd unit got updated again. Find it here.
Also learned today that systemd-analyze security can work offline. And a unit like this can be faked with an instance name. Usage instructions in the .md inside the gist, along with the .service file.
Have been using this on Debian, Ubuntu and Manjaro so far.
// Oliver