but not finding.

Off the top of my head, run sshd on the PC, and a PC connected to the '400, use ssh to connect between the two?

I'm not really an SSH-head, but that at least sounds like it could work. The 5250 would connect to the local SSH daemon, which would forward the connection (encrypted) to the PC running SSHD connected to the '400 which would accept the connection and forward unencrypted 5250 to the '400. Block any telnet connections from anything but the local (to the '400) SSH server

Might that work?

I'm still looking, but all I've seen so far is lamentation re: the lack of SSH support for the '400.