The point they were making was that you could tell via ping times if the traffic was literally being routed through VA unnecessarily because the extra unavoidable light speed delay that extra distance would add between a user and the server if they weren't already very near to VA. Could be mirrored via the type of monitoring you're talking about but that'd only get you mostly encrypted traffic unless the 90s cypherpunk paranoia turns out to have been true.