Tcpcrypt seem it would not be so bad idea, although then there will need some way to configure it, such as a /etc/tcpcrypt file which you can specify what keys to use, where to force tcpcrypt, where to disallow it, what to verify certificates and so on. It can then be protocol independent and not have to deal with individual programs to get it to work properly; you can configure a program that does not understand tcpcrypt to use it, if the other end is also configured to use tcpcrypt (either mandatorily or optionally, depending on configuration).