I spent the evening trying to get the hosts blacklistd to protect a jailed sshd (unsuccessful). Then I asked myself: why not leverage VNET? But VNET documentation is scarce (or my google-fu is too weak).
Maybe I should throw some money at mwlucas@bsd.network and hope that #fmjail unveils some of these mysteries...