The kernel key management facility: where are we, and where to go

This discussion will be about the key management facility (add_key, request_key and keyctl system calls; linux/security/keys/* and the keyutils package), where we currently are with it, what's using it or looking at using it, and how it's being used. I would like to find out what more can be done to it to make it more practically useful, both in the kernel and in userspace. I would also be interested in hearing about problems people are having with it and successes they've had; and any thoughts on the the way keys and keyrings interact would be appreciated.