[kevin_nisbet]

I'm not as sure and would want to consider the angles a bit more.

I ponder how effective this would be against an adversary sufficiently motivated to look like they're not using a VPN. And then does it result in a false sense of trust, since a user thinks the system more reliably detects a VPN then it does. Or an adversary who has bypassed the system to then point to it to build additional trust.