Looks like CIPE has improved a lot since last year. They've added a protocol-level ping (I used to leave a ping -i 30 destination running in a screen session so the NetFilter stateful stuff didn't forget about the connection), public key encryption (uses it to resolve a dynamic shared secret, also handles dynamic IP addresses in a more graceful manner), and probably more stuff that I missed. I'm trying to think of an excuse to use it again; too bad I already run almost everything over SSH tunnels already. :(