Gandi.net Groups

Gandi has placed their public ssh key in root's .ssh/authorized_keys
file.  This makes me think Gandi intends to access my server, perhaps to
help me with problems.  I usually put my public key in that file.  If I
had not, by chance, noticed their key there I put have written over it. 
In this case I appended my key.  

Are there other files Gandi has changed I need to be careful not to
overwrite?

I usually move sshd to a 5 digit port number to reduce log messages from
ssh dictionary attacks.  That will make it difficult for Gandi to login.

Do I need to leave port 22 in sshd?  If Gandi told me the IP address
range they intend to login from I could open a firewall port just for
their addresses

Bill.