[gonnakillme]

Restricting SSH to "known-good" IP addresses is less flexible and less secure than public key authentication.

(Restricting mysql access to localhost and using an SSH tunnel is fine practice, AFAIK.)

[snowwrestler]

It is less flexible, but it is more secure than using public key authentication by itself (public key auth can be used in conjunction with an IP whitelist).

[gonnakillme]

I'm not sure an IP whitelist gives you anything -- it provides a handy mechanism for escalating privileges, both for intrusions on a machine at the "known-good" IP and for unintended network access in general.

[superuser2]

Um. No. Bouncing traffic through one device out of probably many at your house (when's the last time you updated the firmware on your TV? Your router?) is a lot more feasible than breaking public key encryption.