Goodies and Baddies
Telling the difference between 'goodies' and 'baddies' when dealing with encrypted traffic is nothing new. The same problem has existed with physical messaging forever, that's why the plain brown paper envelope was invented. More recently we have "burner" phones. Traffic analysis can potentially fingerprint software but sticking with widely used applications provides the anonymous envelope.
Traditional methods, such as human intelligence sources, still work but scaling them to deal with the Internet is the unsolved problem.