IPSEC: more expressive API errors