[fulafel]

IKE obviously does the key management part, it's part of IPsec in this picture.

There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.