In your previous mail you wrote:
While I wouldn't go quite that far, I've been saying for years that the
IP header doesn't need any authentication if we have IPsec.
=> this is not true for IPv6 extension headers or IPv4 options.
... in a note explaining why I thought AH was useless
=> you can argue this for IPv4, not for IPv6 where extension headers
are really used. Many times some of us tried to remove AH, many times
we vote to keep it: this topics should be in the "oh not this again" list
of IETF and IPsec mailing lists.
Regards
Francis(_dot_)Dupont(_at_)enst-bretagne(_dot_)fr
PS: "NATs are evil" should be in too (:-)!