Port knocking can be automated. Hopefully everyone that needs ssh access is either experienced enough to install the port knocking script themselves, or under IT's supervision so they don't even have to know the port knocking script exists.
Scripting something with port knocking, when you don't actually have the compiler available, or nothing user-writeable is executable is not nice. ssh on a standard port will just work and users don't have to figure out how to activate it. Changed port will take some explaining, but could be used for advanced people.
