Wouldn't you just normally do GRE over Ipsec if you needed layer 2 connectivity? This way your traffic is encrypted.
not trying to hijack this thread but since you mention it– got any decent guides or tuts for setting up GRE-over-IPSEC w/ pfSense? I've not really come across any and the topic has always interested me.