You could do it yourself, but in 2017, I'm not sure optional DIY privacy and censorship-resistance is acceptable. It ought to be done transparently and automatically by the implementation.
Encryption isn't slow, it wouldn't hurt performance or anything like that. Plus, if everything's encrypted, it doesn't attract attention to the people who appear to have something to hide.
The model I have in mind would be what mega.co.nz does: store opaque ciphertexts, and distribute links containing the keys to said ciphertexts. So instead of a link to someproto://hash/ you'd link to someproto:://hash/decryptionkey/. And your IPS/Dat/whatever client would handle decryption for you.