QUIC with RFC 7250 RawPublicKeys is also an option. The rustls guys are working on it.
(Or nQUIC, which is QUIC with Noise instead off TLS)

I've started building a Noise-IK based UDP secure transport, but it's quite app specific:
github.com/firedancer-i...
This could be generalized and is built from just X25519, XOF hash, and AEAD primitives.

Also downright hostile to the Internet because QUIC load balancing and DDoS protection effectively requires decryption & re-encryption.
If you want to serve QUIC, you'll need to enter Cloudflare, Google, and AWS's protection racket

We're moving in the wrong direction. QUIC is an unfortunate OSI violation because it mixes sessions, transport security, and multiplexing into the same.

I hope it's the first one