An error occurred while saving the commentTobias Weisserth commented
This is a major gap that needs to be addressed. The solution should be a built-in Windows feature, not a third party binary that needs to be installed (and trusted). If you lock your Windows Server down with device guard enabled, it's really hard to install anything - and it should be.
Whatever the solution will be, make it a Windows feature, that can be added on the fly with admin rights while device guard is enabled.
And if I had a choice, I'd vote for VIM. Please ship VIM as an optional feature in all major versions of Windows, just like you already ship OpenSSH in Windows the same way.