I agree, it's not necessarily the right OSI layer we should be trying to secure.

Unfortunately, NSA sabotaged IPv6 goal of "encrypting everything by default":

https://en.wikipedia.org/wiki/IPsec#Alleged_NSA_interference

Specifically,

"IPsec was originally required in IPv6 before RFC 6434 made it only a recommendation"