Mark packets critical
Use SHA512 instead of SHA1 and AES256 instead of CAST5 where possible
Use higher s2k count