> How do you deal with MTU? OpenVPN's handing is particularly bad [1]?

MTU is dealt with the same way as other kernel space tunneling devices.

> Is the whole protocol in-kernel or just the data plane?

All of it, which is why there's so much emphasis on simplicity.

> For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy?

Rather, the goal is to make the kernel interface very simple and minimal, so that admins can then glue ontop whatever situation they want. This could be certificates, or pigeons, but the important thing is that it's a layer ontop (in userspace), and not intimately bound to the core.