This week my CRL support for isakmpd has made it into OpenBSD's CVS :-). It makes the use of isakmpd in very large VPN scenarios more feasible.
At the moment I'm also thinking about writing a small HTTP proxy, which allows proxy-chaining and external filters. Squid is too heavyweight for my purpose.
