The GSMA and members (i.e. telcos) have been working on secure remote provisioning. I think it'll take a while for the technology to make it in to consumer devices, though it's likely to be used in IoT relatively soon.
It takes a long time to spec these things up collaboratively and then even longer for telco's to act on it!
See: http://www.gsma.com/rsp/2016/04/27/esim-opportunity-operator... and http://www.gsma.com/rsp/ (Warning: Lots of marketing BS)