CA private key won't help classic (passive) DPI systems. You have to perform active MITM attack. And if anyone's aware of any ISP anywhere in the world, doing

CA private key won't help classic (passive) DPI systems. You have to perform active MITM attack. And if anyone's aware of any ISP anywhere in the world, doing a MITM with a certificate that passes validation, they should really shout about this as loud as they can (or at least whisper to someone who can shout), because it concerns virtually everyone on the Internet.