Port knocking by sending a secret to the server, in a very simple protocol (to the point of being obviously correct), is good. Once it gets too complex, the implementation is more likely to have a bug than OpenSSH.
So just send that secret in a UDP packet. Modulating SYN packets is like sending your password (or other secret) in morse code rather than ASCII, for no reason.
Whatever layers of defense you already have in front of your ssh server, port knocking makes it (very slightly) safer.
If knock/knockd were fragile or complex then you’d need to carefully weigh that benefit against increased fragility.
But it’s not. You get the benefit at no real cost.
(I speak of the knock binary in FreeBSD ports - I have no experience with this weird python one …)