A little progress. I found the SIP registration process actually expects a "401 Unauthorized" with the first registration attempt. That initial 'unauthorized' should contain a challenge. The SIP client then uses the challenge to create a response. It seems the VOIPo server is doing its job and creating the challenge, but my phone is ignoring the challenge and resending the original registration packet. I verified the packet is the same every time my phone sends it except the sequence number.

I suspect a bug so I'll load a later version (9.3.1SR4) later and re-test. If I ever get this working, I'll post the configs!