The part that caught my eye is the extended Retry token format, because once you split the work between DPU and host you usually end up coupling token validity to whatever key or state the DPU is holding. That makes key rotation and rollback a lot less clean than the usual stateless Retry path, especially if the on-path DPA is also doing connection authorization. I’d want to see how often they have to invalidate tokens under rekeying or DPU restarts.

“Retry” is QUIC’s anti-spoofing tax, and floods turn it into the bottleneck.