If the NSA has taps sitting on all the routers that are a hop away from NK, they can probably nail it down just from timing, right? If the packets were being proxied through an NK IP, I would think it would be easy to tell the difference (if you're the NSA, anyway).