The SSH setup is very complicated, going through quite a few layers. Most of the dynamic configuration is handled via ClientFactoryManagerConfigurator, which is unfortunate.

ClientFactoryManagerConfigurator should become known as something else, which supports the client connection.

Essentially we need to align the lifecycle flow with the TLS side of the house – where the lifecycle is to be governed by SslHandlerFactory. We are in a similar situation in SSH, but there are more moving bits and a few more restrictions.

We can think of TransportSshClient/Server as the moral equivalents of a SslContext in client or server mode – except we need to expose properly-encapsulated API.