I am not sure where you are located, but as you run encryption on the VCS and Lync it should not be
an encryption restricted country anyhow, so you should not have a hard time to get the 0$ option
for the encryption key which I would recommend anyhow.
The microsoft media encryption is different from what cisco uses, so if you want to have the VCS to do
the magic you would need the enhanced collaboration key on your lync gw vcs or you would need to
allow non encrypted media on lync.