You are correct as far as basic email only systems on SIPR, but for the command and control functions they are still on NT 4.0.
How do I know??
I work on them.
Crypto is not the issue. Stability, compatibility, and standardization is the issue. Plus of coarse the government beauracracy of upgrading any large systems to higher standards.
I remember when the government set the standards i.e. milspec products. Now ?????