This neatly solves both the problem with local eavesdroppers, and much of the problem where an ISP or law-enforcement fingers you, the billing contact, for the activity of third parties. Their traffic emerges at the other end of the VPN tunnel – somebody else's problem.
And, it doesn't require any new local crypto protocols – just mundane destination/port filtering.
A very paranoid regime could even establish rules to only allow certain accredited VPN providers (e.g. ISPs) to free people who offer open WiFi from the fear of being prosecuted.
I actually saw this back when I ran an open network, in trying to prioritize bittorrent below ssh and interactive traffic. Some remote seeders will operate on port 22 or 443 because that's the only way they can reach the outside world. If an "Open Wireless Movement" using a standard VPN setup took hold, a similar thing might happen with that port.
Of course, without DNS only the savviest users would initially be able to exploit mundane destination port filtering, but it's only a matter of time before one of these users puts together a tool for the masses. So I still wonder about the plausible deniability of such a setup.
With that, you could only use other protocols with those limited destinations if they agree... which typically they wouldn't.