You could identify it as ssh vs SSL because they have different unencrypted headers. So systems which check that you are speaking SSL on port 443 would block ssh.
With HTTPS you get a handshake Client Hello packet sent in the clear, which has a TLS version identifier and a plaintext session ID among other things. With SSH2, you get a literal "SSH-2.0" as part of the protocol identifier which appears before the key exchange.
I'd love to hear about your plans for "deep packet inspection" on SSL packets...
> your only S3 machine could get blacklisted
I thought the whole reason the original article was suggesting S3 was so that you could just spin up a random Micro instance, with a new IP address.