...
Basic TLS interop (through a bridge) is ready to go now - just set the Gateway transport to TLS and change the port to match the remote TLS port (normally 5061often 5061; for sipXecs to sipXecs, use 5081). Note that the remote system may need to be configured to send to port 5081 (the TLS port of a sipXbridge gateway). 
...
Eventually the special internal users (of the form ~~pi~<fqdn>~pi<fqdn>) will be created automatically, and permissions will be assigned to them through the sipXconfig interface.