Did you look at the Communicator.ADM settings? There is a EnableSIPHighSeityMode policy that states::
2 = Security is medium (default). TLS is not required, but server authentication must use either NTLM or Kerberos authentication. Instant messages and SUBSCRIBE SIP messages must pass through the SIP server.
0 = Security is low. Any transport and any authentication method (including Basic or Digest) can be used. Instant messages can pass directly between clients.
1 = Security is high. TLS transport is required. Server authentication must use either NTLM or Kerberos authentication. Instant messages and SUBSCRIBE SIP messages must pass through the SIP server
Did you try these settings? If so, can you share your results?