If you have triple-digit clients then you need automation anyway. What's so hard about rolling out a config change? And it's not like you don't have this with

If you have triple-digit clients then you need automation anyway. What's so hard about rolling out a config change? And it's not like you don't have this with IPSec. It's just a different config change, maybe enabling PFS, or changing the allowed crypto list, etc.