There is existing work on testing the feasibility of impersonating other person's voice. We discuss them in our related work section at the end of the paper.
I think on the long run, SAS will no longer be a sufficient authentication technique due to advances in speech synthesis. To prolong ZRTP's life we propose usage of sentences instead of words/chars. This is discussed in detail in our best practices section.
I noticed that UX/UI is important and a guarantee that SAS should increase in length, what are some of the recommendations that you advise to have a good ZRTP implementation ?
Or should we start discussing the fadeoff of ZRTP and a change to something like Matrix protocol or even Signal's one ?
I know Signal attempts to prevent any data leakage by forcing the Opus codec to use a constant bitrate instead of its default VBR -- I'm not sure if Matrix implements anything similar yet.