it allows easier access to ipsecsa/sp. it works around problem where setkey -D does not work with large number of ipsec SAs due to socket buffer size.
related information together, with the file system code itself. This is just low-hanging fruit -- more to come.