> Perhaps we just don't care; or perhaps "users" can only be IPSec > initiators. That won't work in the general case since many possible uses of ipsec require peer-to-peer keying. (or, rather, require either end to be able to initiate rekeying). - Bill