I was really thinking in terms of coporate networks, which would be considered small. It is already common on such networks to have proxies/NAT/filtering that

I was really thinking in terms of coporate networks, which would be considered small. It is already common on such networks to have proxies/NAT/filtering that inspect and route everything in a very resource unfrinedly way. I would propose creating single VPN tunnel between these corporate networks that all traffic destined for the other network is routed down. Just join individual private networks with encryped tiunnels. This would be completely transparent at the client level as the data would just follow a different path. It would avoid the startup cost of SSL or the higher CPU requirements of symmetric encryption. Such a setup could be required as a contract/tendering/supplier requirement. Really if you have two companies that are sending data that may be sensitive why would you want any of the packets to ever be sent in plan view? Client side standards will never give a complete gurantee of that. It is much more enforcable to add the security at the network level.