Specifically on your side tangent: > especially if NAT traversal and hole-punching keeps advancing I'm wholly against this as it's been implemented now. Only because networks, as they have been designed, rely on very high levels of trust at the moment. Anything that is designed to traverse obscurity and hard protections is inherently breaking that trust barrier. It's an automatic assumption systems behind my firewalls can safely speak to each-other. It's as trusted network, we can drop the firewalls, the added encryption, honeypots, and paranoid routing gymnastics because we trust that, once configured my services are "safe" behind the walls.