Thank you for the comment. I didn't have enough time to finish the paper, so it is more than a little rough around the edges. I have intentionally reduced professionalism in this paper to save time and energy so that I can spend it on more effective pursuits. The reason I tacked on the whole question of "Was IPsec itself poorly designed?" "Why didn't this get reported in 2013?" "What should we do about software vulnerability?" was to get interest from people who generally get nothing from a vulnerability announcement in software they don't use. Thus, the audience of this paper is very different from the traditional audience of people who read vulnerability announcements by the hundreds. Like another user commented, I tried very hard to put the important stuff first so that people like you could stop reading when they became disinterested.

You have convinced me to release a version of the report without the soapbox for people like you: https://www.altsci.com/ipsec/ipsec-tools-sa.html