Struggling with the same problem. So what is the non-'out of the box' file-based keychain solution? In my case the app would be deployed using Developer ID signing.

No, I don't think this is the case. The conflicting VPN profile is NESMLegacySession (IPSec) added manually to the Network preferences panel by the user and NOT the app. I don't think this profile has includeAllNetworks flag set or if it even can have one.

Ok, there's definitely a strange behaviour. If I delete all of the vpn profiles in Network preferences, only then I can connect NEVPNProtocolIKEv2 profile with IncludeAllNetworks flag. As soon as I add any other vpn profile I am no longer able to connect my IKEv2 profile. Even if I manually add some IPSec profile via Network prefeneces 🤯. This makes IncludeAllNetworks flag impossible to use in my vpn app.

Matt, you mean even if none of the profiles are active (connected)?

From log: NESMIKEv2VPNSession... I am creating NEVPNProtocolIKEv2 profile (Native IKEv2 Personal VPN). I also have no other vpn profile connected at the same time. I've tried clearing all previous profiles with no success.