If your origin is disguised by a public VPN, and you require TLS for the endpoints you connect to, what exactly are the agencies collecting,?