Limit rekeying to once every 5 seconds in the server, change the only rekey trigger to be receiving or sending > 2^31 packets.
Accept DATA packets when in the REKEY state instead of dropping them.
Reserve some of the responder tx sequence number space ensure that sending a few REKEY ACKS will be possible.