Personally, I shall some day find the patience to code and test a poor man's zero-trust -- app/site knocking + firewall whitelist.