It's almost certainly a multi-layered approach. While fiber splitters, DPI gear and compelled cooperation are all old news and have been employed at scale for

It's almost certainly a multi-layered approach. While fiber splitters, DPI gear and compelled cooperation are all old news and have been employed at scale for decades now, those methods sound like what you're describing. Compromising the larger web infra companies (read: DNS/CDN/DDoS protection) is one of the more interesting theories I've heard lately for bypassing TLS at scale: https://news.ycombinator.com/item?id=38987074 https://news.ycombinator.com/item?id=38987074