This release also finally compiles NAT-T into the kernel by default. I can finally run a strongswan/ikev2 server without needing to compile a kernel just for nat traversal. woohoo!
I have no idea why they didn't include NAT-T by default in 11.0. I'd hazard a guess that most VPN connections involve at least one end being behind NAT.