An interesting attack and something that we'll consider. HTTP/2 should add a significant amount of noise to this, but ultimately adding random padding to every response or padding that compresses to a consistent length would be the best solution.