As I understand it most of the terribleness is in the key agreement stuff; the actual packet processing is a little ugly but is practical. So you could in theor

As I understand it most of the terribleness is in the key agreement stuff; the actual packet processing is a little ugly but is practical. So you could in theory set up (and regularly update) SAs manually with setkey(8), instead of having racoon do it. For a small network you could presumably lash together some cronjobs to keep this working. Would that be as secure as IKEv2 as actually implemented? I dunno :)