Thank you for the detailed explanation. We are going through the same exercise.
A couple of questions: Did you have to install the modified openfire.jar even after upgrading to 3.9.3
Also, I understand using the nightly build really made no difference as far as federation between Lync and Openfire went? It would still only work without TLS?