Googling around briefly, see references to VPN and WPA2 Enterprise (tunneling in from an untrusted WIFI connection), but unclear whether the Blackberry Bold, Torch, etc. can be used as a generic Mobile IPSec client (Cisco, pfSense, etc.) from the carrier 3G network.
All the pieces seem to be there like certificate store, encryption protocols, etc., but not sure what's required or if at all possible.
Would like to require users to establish a VPN to tunnel into a remote network before accessing a Web application on said remote network with their native Blackberry browsers.
Note: devices are unmanaged and not owned/paid for by the organization, so no BES capabilities.