Now you can build a kernel which support IPsec message authentication but don't support message encryption, by defining IPSEC in your kernel config file and not defining IPSEC_ESP.