In retrospect, I think using TCP_KEEPALIVE would be a better solution to this specific use case. Are TLS heartbeats truly indistinguishable from normal traffic?
Nearly all bitcoin pools utilize TCP keepalive to maintain connections with miners.
These are systems in which performance and DoS resistance are paramount.
I would guess that makes them identifiable?