SIP over TLS (which uses SRTP) is great, but as soon as it hits a vendor downstream that doesn't support it, it immediately gets trans-coded into plain-ole-SIP and is just as insecure as any other VoIP call. This is not a solution by any means, because it assumes that the entire call path is TLS-enabled, which, in my experience, is impossible on the public telephony network.