Keystroke timing analysis has some solid research. See, e.g., Timing Analysis of Keystrokes and Timing Attacks on SSH (https://people.eecs.berkeley.edu/~daw/pap

Keystroke timing analysis has some solid research. See, e.g., Timing Analysis of Keystrokes and Timing Attacks on SSH (https://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf https://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf), Don’t Skype & Type! Acoustic Eavesdropping in Voice-Over-IP (https://arxiv.org/pdf/1609.09359.pdf https://arxiv.org/pdf/1609.09359.pdf). Deciphering content from latencies in packetized speech is likely much more difficult, but I wouldn't put much stock in it being too difficult. Which is to say, if you're transferring high-value information assets over VoIP you should probably assume it's decipherable. That doesn't mean you should change what you're doing. You could simple say, "M'eh, I'll worry about it when it becomes a thing." But I wouldn't assume it's confidential to someone willing to invest the time to target and capture the conversations. And I might leave a few choice comments in the source code and documentation so nobody could excuse imprudent reliance on confidentiality with, "But nobody warned me".