Wouldn't IPsec be just another higher layer protocol to the shim?
Actually, I would like an option to run the shim inside IPSEC. It
prevents meddling by intermediate boxes.
Well, wouldn't the shim seem like just another higher layer protocol
to IPsec?
There shouldn't be any problems with either running IPsec on top of
the shim or the shim on top of IPsec (IPsec on top of the shim on top
of IPsec), as long as both ends agree on the layering. One type of
layering should probably be the default and the other can then only
be negotiated if both IPsecs are shim-aware.