Turns out that, as specified in the RFC, the initial Child SA does not

Turns out that, as specified in the RFC, the initial Child SA does not
do PFS and is assumed to be secured using the DH exchange in the first
handshake.  Thus there is no KE/N payload in the IKE_AUTH exchange and
we must not include a DH group other than None, which essentially means
we must not supply any DH transforms in the IKE_AUTH messages.  So now
we skip adding the DH transforms for initiating and responding to
IKE_AUTH messages.

ok sthen@