After many failures because of broken libraries I managed to decrypt my problematic TLS sessions providing the private key of kamailio to wireshark.
With TLS+SRTP enabled my nokia phones send session progress and pracks with rtp port. This breaks NAT/rtpproxy in kamailio, which replaces the rtpproxy port in session progress, but then forgets about it for the 200 OK.
Attached is a tree overview and the conversations of each phone with kamailio.
hiro