Because SAs and Flows are defined by policy, gif(4), gre(4), and vxlan(4) can be used to provision IPSec solutions.
Here is an example I deployed using gif(4). Implementation of VLANs (802.1Q) eliminated the need for this particular solution, so it is no longer provisioned.