From a theory point of view, adding "bogus calculations at random places" would probably just increase the number of measurements required - it would introduce

From a theory point of view, adding "bogus calculations at random places" would probably just increase the number of measurements required - it would introduce additional jitter above and beyond the large amount already accounted for in the attack documented in the paper, but the central limit/tendency over a large enough set of repeated measurements would still have multiple peaks. Adding a minimum wall clock floor (i.e. simply waiting to release the decrypted data to a client until a given wall clock time has passed from initiation) would close the door on this particular remote exploitation, although it would leave the door open to local/hardware attacks (power, frequency-analysis, parallel process checking P-states as the oracle instead of overall timing).