3CX,
This is definitely a feature we would be interested in and would be willing to work with you on. As noted by your customer, there are certain industries where the privacy of the media stream is important. By ensuring that the data is encrypted from the 3CX server to our gateway, it would mitigate the possibility of an attacker listening to the stream via a device in the datacenter on either end, and also would render attacking the PBX directly a moot point.
I would have you think from an attacker's perspective. I spot a high profile target talking on a cell phone (using the 3CX app) on a public network. My sniffing indicates that the stream is encrypted and so I cannot harvest the data I need on that network. However, I can see the server he is connecting to. I now have my next attack vector (the IP address of the server he's connected to). I will begin to attack that server. Given enough time and the typical lax security of a private network, combined with the juiciness of my target, I may find a way into your server. With SIPS and RTSP to the provider, however, my attack just became that much more complicated. I now have to crack the provider's network, sift through all of their calls to find the traffic I am looking for, and then harvest the data I need (and this assumes that the traffic there is unencrypted). The attack becomes increasingly more complicated, and the return on investment diminishes which is exactly what your customer is after.
