If CloudSigma is using SSL with forward secrecy, tapping the fiber would be pretty useless.

Unless you're suggesting the NSA has compromised CloudSigma's internal network, which is possible.