A hospital is deploying a new VoIP telephony system. During a security review, an analyst captures traffic and finds that call setup messages containing extension numbers and caller identities are transmitted in cleartext, and the voice media streams can be reconstructed from captured packets. The security team must recommend protocols that protect BOTH the signaling and the media portions of the calls. Which combination best addresses this requirement?