I was able to compile klips setting KERNELSRC to a copy of my kernel without the patch-o-matic ipsec patches applied. But I don't know if I am doing the right thing, i.e. if it is right to have the kernel compiled with a set of code (patched) and klips with another set (not patched).