IPSEC: restack SAs on backend change