Security Architecture for the Internet Protocol (1995)

There's some interesting historical context in how IP was envisioned to have host-to-host (aka end-to-end) security, vs only the gateway model that won out. It's somewhat different from the "overlay network" we know today in that hosts would just use their normal IP addresses but negotiate to use IPSec to communicate between them.

3.2.2 Usage of ESP

   ESP works between hosts, between a host and a security gateway, or
   between security gateways.  [...]
    When both hosts directly implement ESP and there
   is no intervening security gateway, then they may use the Transport-
   mode (where only the upper layer protocol data (e.g., TCP or UDP) is
   encrypted and there is no encrypted IP header).  This mode reduces
   both the bandwidth consumed and the protocol processing costs for
   users that don't need to keep the entire IP datagram confidential.