They can intercept DNS, they can snoop on cert names, they can monitor any unencrypted traffic (you'd be surprised how much there is even when you think you're hitting every site with HTTPS..)

That's also true, especially in the case of end-to-end asymmetrical encryption such as SSL.