[nine_k]

Consider Wireguard: it works at IP level, but gives you identity by crypto key. You can live without proper DNS in a small internal network.

(This obviously lives well without the IP certs under discussion.)