RB1100AHx2 is your best bet. this will give you 800Mbps of ipsec and still room to move. Any of the ccr will also work and any modern x86 will also be fine.
They seem like big steps but really all over the MIPS series just fall short of meeting that criteria once you load it up with a half decent firewall. A rb800 or 493G or 450G would probably get you to that mark but it wont leave you alot of room. The new RB2011 cpus can just scrape the 20Mbps barrier one way.
From what I have tested from home (50/2.5mbps cable) to office (100/100mbps) a RB2011 can handle the load without problems (depends a bit on the encryption used) if you keep your firewall setup rather simple and don’t do too much other stuff with the box.
It makes an easy and inexpensive solution that holds until you need / get your fingers on something more powerful.