webroot FTP with local chrooted user?

[rcfa]

pfSense allows for creation of users with a chrooted scp/sftp only access privilege, which is unfortunately completely underdocumented:

https://forum.netgate.com/topic/185794/there-s-absolutely-no-useful-documentation-on-user-system-copy-files-to-home-directory-chrooted-scp

If I understand the process correctly I should be able to create a acme-challenge user with chrooted only access to the home directory and no login privileges besides scp/sftp, which I think should be secure enough for my purposes.

Has anyone done that? Or, if not, anyone figured out to set up such a user properly, given the lack of documentation?