Options to secure communications between datacenters connected by some ISP or a dedicated dark-fiber.

---

We have 3 DCs connected with a dark-fiber and aerial as a backup. While dark-fiber is a point-to-point with no active devices in between, the aerial backup does traverse the ISP equipment, and we would like to encrypt the communications at network level, while mantaining OSPF or BGP (eVPN?) as control plane.