If you didn't need many features, you could theoretically wrap mqtt in dnscurve payloads; lighter weight than tls and still very secure.