Technically you could use a ProxyCommand that does the knock and then runs nc to your target.