The problem is though that it just ends up with any traffic being throttled unless it can be identified as being a 'wanted' protocol, and while that may not be liked it's a perfectly legitimate thing for VM to do.
And yes it's not hard to shape things, you don't have to shape based on protocol, you can shape based on destination, number of TCP connections, source, TCP port, whatever you want.
Not sure if the quote was aimed at me or if you were just pointing out the things I mentioned above regarding behavioural shaping and SSL CA chains / self signing / SSL proxying and putting them in a somewhat better way
