CentOS

Seems to me adding such a thing seriously undermines the integrity of openssh and openssl. Or am I misunderstanding what is actually being requested?

No, I don't think you're misunderstanding it at all, those are exactly the concerns that I had when I called it a stupid idea

Put simply, you don't need to see the bad passwords to block accounts. You need the IP address/username of the account being attempted. That is already logged under /var/log/secure.