> HTTPS. They can't tell what URL a user is requesting.

I am sure they have a private key of some of the CAs shipped with major browsers lying around somewhere...