No new systems need to be developed, only a will to deploy existing systems. To the best of public knowledge, Curve25519 with AES-GCM or ChaCha20-Poly1305 is good enough to keep the NSA out for years. These are available in TLS, OpenVPN, and WireGuard.

Longer term, TLS, OpenVPN, and WireGuard all need to standardize post-quantum key exchange (such as Chrome's TLS experiment to run Curve25519 and RLWE key agreement protocols in parallel and run both outputs through the final key derivation function). But, for today, the main problem is deployment.