TLS tunneling is common. v9fs and diod give SSH port forwarding as an option. It's very generic, so the options are plentiful. 9P is formally transport-agnostic, from what I recall. Plan 9 natively preferred IL over TCP for a while before officially deprecating it around 2003.
It's just SSL; you can get more information at http://plan9.bell-labs.com/sys/doc/auth.html. There is also factotum, which serves a purpose somewhere between ssh-agent and an OS X-style Keychain.
