Oh, I'm in the camp of wanting a table for each type of SA. Indexed by the fields that uniquely identify that SA. (For AH and ESP, that's destination IP address and SPI.)