You can point-to-point encrypt a single fiber segment at the physical layer. This is what classified networks do and why they're able to use the same public backbones as the Internet, even though most of the traffic is probably also TLS packets to begin with. This way, even the addressing metadata is encrypted.