Nope, you can't secure your web traffic unless you can authenticate the web server you're connecting to, because otherwise you could be talking to an NSA "Man in the Middle" (MitM) attack box (think of a web proxy that intercepts and snoops on, but still forwards, all your communication with that web server). If you didn't authenticate the other endpoint of your encrypted session, your encryption partner might be the NSA's MitM and not the actual website.
Unfortunately, there's no reliable or widely-deployed way to authenticate web servers that the NSA can't get around.
You mentioned IPv6, but that's no real solution. At one time, a somewhat obscure IPv6-related spec document said that IPv6-capable hosts "MUST" support IPsec, but that was downgraded in 2011 to a "SHOULD". And even if it hadn't been, it's not like there were "IPv6 police" out there to revoke your "IPv6 license" if you didn't put IPsec support into your IPv6 stack. And even if you could count on every IPv6-capable host having IPsec support, that doesn't mean it's enabled and properly configured such that you could take advantage of it. And even if you could take advantage of it, the typical host authentication methods use X.509 certificates just like SSL/TLS, which as I just mentioned, the NSA has been known to break. And then there's John Gilmore's assertion that NSA employees inserted bad requirements into the IPsec standard, and overcomplicated it to the point that crypto researchers don't even try to analyze it for security.
So maybe you figure, "Hey, those MitM attacks seem pretty targeted and expensive, maybe I won't get targeted, so maybe I only care about making sure my data doesn't get caught up in the mass dragnet programs", which I'd counter with, "yeah, but the Tor user unmasking attacks are targeted and expensive too, but you still thought yourself likely enough to be targeted that you were looking for something better than Tor". And then I'd follow up by noting that the NSA considers encrypted data suspicious and claims the right to keep it until they can decrypt it.