Yes, it is possible to use nested VPNs. This is actually less uncommon than you think in higher security environments.
Please see below for the more common use in higher security environments
1 Host A --------Router/FW ---IPSEC GRE -------------- Router/FW ------ Host B
2 Host A ----IPSEC in Tunnel Mode ------------------------------------- Host B
3 Host A -- Secure protocol, take your pick, ssh, etc ----------------- Host B
4 Host A -- Cleartext / Insecure protocol ----------------------------- Host B
Layers 3 doesn't get you that much extra but it is a possibility!
In the DoD, it is not uncommon to see
1 Host A --------Router/FW1 ---IPSEC GRE----------------- Router/FW10 ------ Host B
1 Host A --------Router/FW2 ---IPSEC GRE----------------- Router/FW9 ------- Host B
1 Host A --------Router/FW3 ----IPSEC GRE---------------- Router/FW8 ------- Host B
2 Host A ----IPSEC in Tunnel Mode ------------------------------------------ Host B
3 Host A -- Secure protocol, take your pick, ssh, etc ---------------------- Host B
Notes on your objectives:
1) Encryption does not mean unreadable to an IDS. Using preshared secrets or a certificate will enable the IDS to eavesdrop for a performance hit.
2) You can have network authentication via 802.1x
3) You'll want to use AH for visibility to an IDS, if you cannot share secrets/certs
4) Use ESP for confidentiality
5) Host-based IDS on local and distant host can alleviate need for sharing secerts/certs
6) NIST 800-77 Guide to IPSEC VPNs is a good free publication on this subject.
If you are so concerned about the value of the information, maybe you should step up from IPSEC to something more secure like HAIPE, and start looking at type 1 encryptors? :)