HIDE openvpn/shadowsocks from provider

You need to use static PSK, then there are no identifiable packets in stream. Still worth having at least national intranet being browsed outside tunnel to simulate presence of human life.

Also if you consider your provider an adversary (you do)