The latter, however, should be preferred as a permanent solution. The Web is by no means the only part of the Internet that needs to be secured.
It doesn't protect the mapping between a computer name and a IP address, but that's not its job.
So, IPSEC is a non-starter.
In contrast, TLS requires using a new client library and works just about everywhere. All of the work people have been doing to switch to strong crypto everywhere and deploy things like perfect-forward security? Imagine how quickly that'd have happened if it required everyone to install a kernel update.
Until IPsec becomes easier to use (something as simple as checking that a socket is actually secure used to be shamefully under-documented) the best way to think of it is as a potential replacement for proprietary VPN protocols. Anything which cares about security will still need TLS over that so most people will simply use only TLS.