Google clearly suspects the NSA is installing devices on the leased lines they use for inter-datacenter communications.

Properly implemented, this will stop that.

The NSA has broken SSL and VPNs by corrupting the CAs and the VPN vendors.

I suspect Google won't use a commercial VPN implementation. Corrupted CAs can be bypassed by using self-signed certificates, which will be fine for communication within the same company.