Question: if you control the traffic layer you can easily disrupt opportunistic encryption (STARTTLS & Co) by killing public key exchange, or even do a MITM.
Is there any infrastructure in MTAs for public key caching, and admin notification if things look fishy? (Fishy: a host which used to do PKI with you suddenly says it can't, or its key differs from key you cached). (Okay, it's unlikely, but maybe people have been anticipating this).
