The benefit of TLS is widely deployed certificate infrastructure. If you could find a way to keep the server certificate infrastructure intact while cutting out

The benefit of TLS is widely deployed certificate infrastructure. If you could find a way to keep the server certificate infrastructure intact while cutting out most of the ugliness of TLS, that'd probably be a workable solution. FWIW though, TLS 1.3 (the only currently supported TLS in QUIC, AFAIK) is a lot less hairy than TLS 1.2 and earlier; and most of the primitives are the same as you would use for noise (i.e. standard AEADs like ChaCha20-Poly1305).