I really think tox is a cool idea, and I've used it quite a bit, but I think it's important to temper security expectations. I can't find a link, but I remember the results of the security audit done in the project to be frankly disastrous.
https://github.com/irungentoo/toxcore/issues/121
I couldn't find any evidence of an audit.
There is an actively developed Rust implementation of the core library here:
Of course, any flaw in the specification (for example with respect to key exchange) will still apply if they've faithfully implemented it.
https://github.com/irungentoo/toxcore/issues/1398 - discussion on homepage claims
"Neither the Tox protocol nor the implementation have undergone peer review, and its exact security properties and network behaviour are not well-understood, yet. We are actively working on improving that situation. Until said peer review, Tox is not recommended for use cases that require proven, high-assurance security."