i just thought i'd update this. we are about to switch to vbv. our payment processor allows us to collect all customer card details on our server, then post these to an iframe for authentication, next to which we have clear instructions on why this extra step is necessary.
i'll start with A/B tests and hopefully switch to all orders. i'll post again in a few weeks with results.