It is. DTLS-SRTP is required for media. The SCTP data channels are also layered on top of DTLS [1]. Now, obviously one "end" might be a conference mixer with

It is. DTLS-SRTP is required for media. The SCTP data channels are also layered on top of DTLS [1]. Now, obviously one "end" might be a conference mixer with unencrypted access to the PSTN, but direct browser-to-browser connections will be encrypted and there is always the DTLS fingerprint to guarantee that you're not being MITM'd. See <https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch> https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch> for more information about the security architecture. [1] DTLS is just TLS with the obvious extensions needed to work over UDP instead of TCP.