One warning on AES that I have noticed, on some XPR7550e radios I purchased as "depop" models (do not have chips installed for Bluetooth, WiFi, or GPS and with Entitled ID's for AES-256 encryption.....many of the later batches of these Trbo series radio had an issue with Hex and the use of the letter "F". (You can't use the letter F for Hex Radio ID's either).
I was promised a firmware upgrade to fix the issue, but this was at the end of production of the XPR7550e series radios. Now, I am waiting a "depop" version of the R7 Trbo radio, which is current production.
There was also the issue with registering the EID's with Motorola's server, enterprise firewalls, and then making sure each radio had the same key.
You get 40-bit encryption from the factory, and AES-256 on Trbo is possible, but sometimes more problems than it is worth. There are entities that get this approved though, and not necessarily government entities, I work for a corporation that managed to jump through the Motorola hoops.