Thinking in "layers" can be confusing. Layers come from the OSI model which was meant for another set of protocols, former competitors of what became TCP/IP (the "Internet protocol" that we use nowadays). If you want to put SSL into the layers model, your more-or-less have to put it on layer 6 or more, but also below layer 4 at the same time, which does not work. The "layer model" cannot really digest SSL.
When you want security, when talking to "a server", you want several things:
- Confidentiality: people who can spy on wires must not be able to understand the data you exchange.
- Integrity: people who can plug on wires must not be able to alter the data while it transits.
- Authenticity: when you talk to a server, you must have some reasonable guarantee that you are talking to the genuine server, not to some attacker-controlled faked.
SSL is "end-to-end": it ensures these characteristics regardless of how the data bytes are physically transported. Encryption systems applied on "lower layers", usually, lack this wide scope. E.g., when using a WiFi access point, there is some encryption which occurs between your laptop and the access point, but it stops there. The access point itself, and routers beyond that access point, will see the cleartext data.
There are end-to-end protocols which purport to integrate with TCP/IP at a lower level (e.g. IPsec), but they don't get used as widely as SSL for "usual browsing" because of historical tradition. Indeed, if you want some security between your Web browser and a Web server, then both the browser and the server must support the same relevant protocol and agree to use it; right now, the only protocol which "works everywhere" is SSL (which is why people concentrate on SSL support, which is why SSL works everywhere, which is why people concentrate on SSL support, which...).