DTLS is the general "drop-in" TLS for UDP. It does have limitations and compromises, esp. in regards to real-time media, but this does seem like a situation where it would not be especially difficult to send this data over a DTLS-secured channel which is logically separate from the media.

Even with UDP it's still not hard.

Sure getting it right might be hard, but getting it somehow good enough to not be obviously bad is much less so.

Not only are there thinks like DTLS, in the worst case you could just "ship" a AES key when you login over TCP/TLS and then you encrypt any udp message with that key or something like that. Sure there are many ways you can get it wrong but it's easy to setup and better then plaintext.

And get the certs working ?

Why bother , move fast and break things yo