east does not yet run libreswan. Road attempts OE, and installs a %pass.
east is then started and triggered by a packet and initiated OE to
road. Road must replace the %pass with the tunnel.

because both ends are private-or-clear, and the ping on east sends more
than one ping, both ends will trigger OE to each other.

NOTE: we end up with two states but one set of policies in the kernel ????
      This might cause problems if one of the two tunnels is deleted

NOTE: road shows a %pass bare shunt in pluto, but not in ip xfrm pol?

same as certoe-18-pass-then-go-slash24 but now the OE policy on road is a /32

NOTE: the timer is not really needed anymore because the IPsec SA triggers
the %pass shunt removal.

NOTE: A keyingtries=0 really makes no sense for OE. After the first keying try
the failure shunt is installed. And the keying attempts should die or else they
are just added from all nodes that dont run OE.
