So I spoke to someone that sounded a little more knowledgeable that the others... he said that the Samsung must have a VPN "chip" that enabled support for Cisco and JunOS Pulse, so the Surface RT will never see a VPN client.
That seems hokey to me since VPNs are software driven (although could be HW accelerated but aren't on most handsets).
Is there someone from Microsoft out there willing to weigh in on this? I know you're reading because I can see MS employees and forum mods posting to other threads...