The traffic from the enduser should have 3 layers of AES256 encrypted traffic, am I right?
Yep. The trouble with this traffic capture is it also contains real Tor client IP addresses in it, not related to the Renault case. Using Tor is not (yet) a crime in France, but with all surveillance bill currently passing on our country…
Regards,