> No; no ISP would ever run externally managed equipment inside their network.

You haven't been paying attention to that Edward Snowden fella, have you?