it allows easier access to ipsecsa/sp. it works around problem where setkey -D does not work with large number of ipsec SAs due to socket buffer size.
