From another subthread, https://github.com/trailofbits/algo is an ipsec-only alternative to streisand that looks good (although it requires an app to be installed on android). They also get ipsec working on aws/gce, so apparently whatever obstacle streisand faces with this configuration is solvable.