No new systems need to be developed, only a will to deploy existing systems. To the best of public knowledge, Curve25519 with AES-GCM or ChaCha20-Poly1305 is good enough to keep the NSA out for years. These are available in TLS, OpenVPN, and WireGuard.

Longer term, TLS, OpenVPN, and WireGuard all need to standardize post-quantum key exchange (such as Chrome's TLS experiment to run Curve25519 and RLWE key agreement protocols in parallel and run both outputs through the final key derivation function). But, for today, the main problem is deployment.

If you are the security services, with an unlimited budget and carte blanche to do whatever you like, then you can covertly place equipment at either end of the communication. If the equipment is in your country, you can coerce the company to install your equipment under the guide of "national security".