"Always-on" VPN functionality like MS direct access would be great. To be secure it would need to leverage a clients TPM for authentication, be integrated with AD certificate management and be configurable to only allow access to defined services without further authentication.