There are many ways of seeing if a host is running a VPN, and then sniffing out VPN handshakes. China does an automated scan of basically every unfamiliar host on the internet when someone inside China connects to it, specifically to check for VPNs and the like.

It is possible to set up tunnels which are difficult to detect by using pre-shared secrets and obfuscated transport, but right now this is uncommon and takes significant effort and still isn’t legally or technologically bulletproof.

Remember, my doomsday scenario here is that a Republican gets elected president and can leverage the NSA to assist states in “enforcing their laws.”