I'll note that, in practice, the NRL IPsec code is available outside
the US from ftp://ftp.ripe.net/ipv6/nrl/.  RIPE lags a bit, but
generally seems to mysteriously end up with each NRL release.
This might not conform to US law and I don't know how it happens,
but there it is...

One feature of the NRL code is compatibility with the cisco ISAKMP/Oakley
key management daemon (via PF_KEY).

Nothing against the work of JI or Angelos, but what should matter is
availability of software, not location of development IMHO.

The NRL IPsec code will drop-in to NetBSD 1.2 with little effort
and NRL does support NetBSD as one of their standard platforms
(along with BSDI).

Ran
rja@inet.org