Yup, but I'd go even simpler. Imagine An OS-level switch to put arbitrary network traffic over TLS. I'm sure you'd need various switches for edge cases, custom

Yup, but I'd go even simpler. Imagine An OS-level switch to put arbitrary network traffic over TLS. I'm sure you'd need various switches for edge cases, custom keys etc, but... imagine. Quick and dirty network apps? Half the security battle is done. Crusty endpoint security solutions downgrading your encryption? No need. Malware sending an encrypted traffic? Stands out like a sore thumb, because it's the only thing not sending cleartext to the socket. Yes, if your OS is compromised, your processes encryption is. Guess what - that's already the case.