[gcoakes]

What non-malicious use case is there for this?

[some_random]

Network monitoring for unauthorized/unusual access, reading more into how this works I don't think this would actually change anything, you can probably still discern scripted vs manual shells it would just be a bit harder.

[eli]

presumably for checking compliance with a policy that forbids it