How is this any better than using SSH tunneling?
As a platform as a service provider, we've faced many challenges while operating OpenSSH for our customers, ranging from managing authentication with its authorized_keys files or custom patches, integrating with existing auditing systems and so on.
I'm not giving up on SSH for CloudFoundry altogether, but Caldecott is an elegant solution that fits our constraints and solves one of our customers' problems.
The Stackato client supports this now as well.
http://www.activestate.com/blog/2011/12/new-stackato-client-...