I was thinking about two things :
As you said, when the connection is established, I was suspecting that something would happen differently , but not sure how differently. You answered that part.
Then I thought that the shape of the traffic would be very different of the average person browsing the web : I would expect a vault to produce a very constant and almost full bandwidth over time, in both ways. I suppose it would look much like someone torrenting, maybe, which would not need dpi to be spotted.
This would be more than enough to ring the bells in many countries with restricting laws on digital communications and privacy, such as several European countries since a couple years, where governments are allowed by law to install sniffing machines and / or software at the ISP level, without any warrant.