I'd start by making all network protocols stacked flat with metadata about their being joined together, rather than loosely embedded in one another like matryoshka dolls. This can be done using existing protocols by demarcating each stack layer in an existing stream and adding metadata to link the parts together as they are composed. The end result is that the entire network path is preserved and available for inspection at any point along the network path. By using the metadata, each layer can remain private, but also be directly accessed by any network node that has the proper authorization to view it. This solves service routing issues, middleware issues, application-service integration issues, and end to end security issues.
Wrt our current conversation, you could have a network filter which only allows network communications whose packets at a particular layer are authenticated by a particular identity provider, authorized by a particular service provider, encrypted by a particular standard, and pass only a particular set of data using a particular data standard.
But looking further, you could have much bigger impacts. For example, right now we have to use NAT for IPv4 because there's no way for a private network to route directly to public networks and vice versa. But with this new scheme, the route tables, host addresses, the DNS, TCP protocol, service address (the address of the service should not require numbering at all, it should just pass a URI and boxes along the way should translate how to route to it based on that local network's definitions), and the various data payloads and formats, all would be delivered to every hop along the way up to the app server. The server reply would be carried back the same way just by reversing the order of the path. And so you could actually route messages between multiple sets of public and private networks, and those networks would allow the traffic or not based on the authn+z protocols and policies at each segment.
(Particularly, the application on the user's device would be prompted by the OS whether to accept the packets, similar to how the application firewall works. Except it could actually verify that each data payload was not just signed by a key on a random load balancer, but that it's actually been passed by an application with a valid OAuth session (but not OAuth since much better protocols would be used))
None of this assumes backwards compatibility (again, it's a revolution, not an incremental change). But there are some hacks that could be used to implement some of these features with existing protocols, to make transition easier. However, it's been shown time and again that all we really need to implement breaking changes in internet infrastructure is for a sufficiently large company to force it.