east does not yet run libreswan. Road attempts OE, and installs a %pass.
east is then started and triggered by a packet and initiated OE to
road. Road must replace the %pass with the tunnel.

because both ends are private-or-clear, and the ping on east sends more
than one ping, both ends will trigger OE to each other.

NOTE: road shows a %pass bare shunt in pluto, but when shunt is deleted, not
      the shunt but the tunnel out policy is deleted.

NOTE2: once fixed, if the tunnel is brought down, who will bring back the %trap ?
