can be defeated with two VPSes, but that’s increasing complexity and cost

A marginal increase, perhaps. You don’t need a separate VPS - just a second IP. Accept incoming traffic on port 22 on one, and set the default route for outbound traffic to the other.