Agree re VPN reliability on 3G. Proper pain to have to constantly reconnect.
On jailbroken devices you can install stunnel, which allows you to connect like this:
iPad Client App -> localhost:12345 -> SSL tunnel -> server:54321 -> localhost:3389
Completely transparent, on-the-fly encryption with PKI access control (ie. only certs cut from the CA referenced by the server will be allowed to initiate an SSL connection).
The guff referenced above re Java/ActiveX is in regard to "clientless" VPNs (Citrix Access Gateway is a good example) which use a browser plugin instead of a standalone client.