Hi, my RT-N16 has full NVRAM because of many different VPN certificates I use. It seems quite wasteful to use VPN for these, they are several K of datas.
I have one suggestion: just let the user specify the full path to an existing file (it might be in JFFS or USB disk or CIFS or wherever). Then, in rc/vpn.c, when you create the files, if the first character is a "/" it means that it's a path to a file, so just create a symlink. If you use symlinks there should not be many race conditions because even if the file is not immediately available at boot, it will eventually become available after the boot sequence complete, so the symlink will become alive after a while. This will save tons of NVRAM for me, and it's perfectly backward compatible (there's no way for an openssl key to start with /).