The issue is that IP is generally handeled by the OS. This means that IPsec also needs to be handled by the OS. The thing is, how you set up (mutual) authentic

The issue is that IP is generally handeled by the OS. This means that IPsec also needs to be handled by the OS. The thing is, how you set up (mutual) authentication is very much an application level thing. Do you want certs, an SSH key, passwords, hardware tokens, SIM based authentication, or something else? These aren't things the OS can decide, and they aren't so simple we could tell the OS what we want with a few flags.