But how easy is it to actually make up what’s going through a socket? If my ISP sees 1TB of data being continuously downloaded (from another IP address that they don’t already know what its usually involved with) maybe I’m downloading some illegal movies, maybe I’m retrieving a hard drive backup, right?

Torrent traffic that doesn’t go through a VPN is probably easy to make up, it’s tons of packets from 50+ addresses, but if it’s a Usenet download from one address, or SSH traffic from a seedbox, that should be more complicated to figure out right?

But so does TLS right?

Well I was mostly thinking about Usenet but I guess everything else applies. Websites really can leak everything.