This tip solved the problem, and another one I didn’t know I had (how to disable password authentication for remote access, but allow it for local access).

The short version, just edit

/etc/init.d/S50dropbear

to start dropbear with the desired options (dropbear --help), and for the remote vs local access, start two instances on different ports, then set your firewall to only allow outside access to the dropbear instance that disallows password access.

And since this is my outsourced memory and I have to edit files on OpenWRT using vi, here’s a quick list of commands:

• i before you insert anything
• esc to get back into command mode.
• yy from command mode, to copy the current line,
• p to insert the copied line after the cursor.
• :wq to write changes and quit
• :q! to quit without writing changes, if you’ve screwed up.