Well, IPIP itself is not the problem. It avoids the costs of Internet BGP peering. What is a problem is the lack of dead-peer-detection between IPIP gateways. If intra-AMPR BGP peering was actually deployed as part of the general recommendations then we wouldn't need to anycast to achieve redundancy. But as it stands, the deployed technologies are very light, and anycasting our IPIP endpoint is the easiest way to achieve the desired redundancy. We do plan to make special BGP+IPSec arrangements with select AMPRnet peers to further improve our availability and security, but there's no need to do any of that work on the mailing list.