Background:
IPsec has been using its own BPF program (bpf_network) on the Ingress of native network interfaces, to handle inbound IPsec traffic. This gets configured via --encrypt-interface.

But as the support for IPsec in the "normal" from-netdev program is stabilizing, we eventually want to remove the bpf_network program.

Proposal:
Deprecate the --encrypt-interface option, and fully replace the usage of bpf_network with bpf_host.