Just a brief reply, I agree that we don't usually want to be in the business of forever maintaining patches, so they should be sent to the upstream developers for inclusion, and if they refuse them, then we either keep maintaining the patches (if they are valuable and someone wants to continue maintaining them) or we remove them. So far someone has wanted to maintain this openssh patch. I don't use it so I don't know how valuable it is.
It's not uncommon for someone to forget to delete a patchfile when they remove the reference to it from a Portfile. If you find such a situation, you can delete the unused patchfiles. There might be a very small subset of those cases where the unreferenced patchfile was deliberately retained on the theory that it might be needed again in the near future. But deleting it is fine since if it is needed again it can always be retrieved from the repository history.
