Couldn't you also just set the VPN to use port 443?

E: Apparently this isn't enough. IE, for Wireguard, you would need to find a way to obfuscate the handshake.