[tptacek]

Right, but this is a solution in which you're meant to control both ends (IPSEC runs from Vita to Vita). That's an ideal environment for WireGuard.