Where can I find a description of the various IP tunneling devices in 1.4.x?

The man pages describe setup and such, but what exactly do they put over
the wire and why might I choose e.g. tunX vice ipipX vice greX?  Do any of
them include encryption?  If not is ssh still the prefered encrypted
tunneling mechanism or is there something related to IPSec which is mature
enough?

An answer to the first question would likely allow me to answer several of
the others, hence the subject line.

Signature failed Preliminary Design Review.
Feasibility of a new signature is currently being evaluated.
h.b.hotz@jpl.nasa.gov, or hbhotz@oxy.edu