If we dont need to be compatible or world-open, we just dictate... just use SHA512 or better, just use aes-256 etc..
okay for Webservers we need to obey (maybe) some minimal algos, but...
i think we just need to support current firefox, chrome, edge, and lynx/wget.
so we need paranoia-templates, so we can save them once and reuse them everytime we create a new ipsec dialin, a new cert, etc.
also we need presets for lame vendors who just support RSA2048+SHA256.. maybe we could name these presets like the vendor netg*** and so on.
Off-topic: also we need export options for exporting certs in different styles like binary/ms rdp style etc...
The best place for feature requests is github.