[ranger_danger]

My understanding after talking to OpenVPN developers is that a known header is exchanged PRIOR to starting a TLS session, thus making it extremely easy to detect (and block).