What if confidentiality and authenticity would be handled by IPSec/DNSSEC instead of using solutions at the transport layer? This is not my idea, or new, but it makes more sense to me. Why do we move towards implementing security measures higher up in the abstraction layers when it should be a core part in any system?