Are you just repeating words you found elsewhere in the thread? You'll be hard pressed to find a crypto system that doesn't require implementations at both ends. NaCL is the library used to implement DNSCrypt, which is pretty much ssh for your DNS queries.
I just looked at NaCL. It only works if both sides use it, but data at rest isn't the big problem. Servers are.
And this doesn't work if you want to make a replacement for ssh.