https would stop injection just the same and is just http-over-ssl/tls. You could also simply sign the the content (but that would still allow wire-tapping).

Both still leave the original text based protocol and would stop ISP header injection.

Another defense against such trickery would be a legal one: make it illegal to tamper with data sent between two peers on the internet.

Imagine the postal service opening your mail and changing a couple of words in your mail just because they could.