I can't find the bits about updating firewall rules, but anyways... They keep concentrating on the media path, while getting the signalling to the right place is just as hard. They need some public relay and that's one part I still haven't seen seriously mentioned yet. I disagree with "Actual NAT traversal in SIP/RTP is very straightforward." - since there are many issues:

- They can't use end-to-end encryption since public relay has to add information about the public address the message came from (unless it wants to transfer the media itself).

- They can't allow random changes to addresses by intermediate nodes, since that would allow trivial attack on the mesh infrastructure.

How will they stop a situation where someone creates lots of nodes, proxies SIP, but randomises the media addresses? Media address can't be encoded at the source, since it has to come from the relay. It wouldn't be hard for a competing company to spawn thousands of nodes on EC2 and overload the network with broken "relay" nodes.