I can easily imagine an authority issuing a warrant to rsync.net without knowing that there is a canary in place. It seems less likely for an NSL with an attached gag order, but still possible.