Use new IPsec EKU. Could break outdated Mac OS X, but that doesn't matter.