There are some clever tricks adversaries can do with DPI. One thing was that Tor originally used SSL certificates with very short expiration times and rotated

There are some clever tricks adversaries can do with DPI. One thing was that Tor originally used SSL certificates with very short expiration times and rotated them frequently. That's very distinct compared to "real" https traffic, since no one waits until a certificate is a couple hours from expiration to replace it. My understanding is that now they still rotate certificates, but they set the expiration date much farther out in the future.