You do realize that those machines are not necessarily NixOS right? It is best to separate the management of SSH from NixOS declarative nature since what you would really want to be declarative is ACL rules, not network topology/SSH keys. For example you can use Netbird or Tailscale and their respective SSH feature.
You might be interested in https://mupdf.com/wasm/demo/index.html?file=../../docs/mupdf_explored.pdf, as I’ve seen people recommend this for large PDFs that would lag out even native viewers. I don’t know about flickering though as I haven’t tried it out much.