Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow to an observer? If so, how would a site remedy this?
Yes, if the site is public and its content is known to the attacker, the attacker with access to the encrypted traffic can find out which page on the blog the user visited just by measuring the size. The website could remedy this by padding all lengths of all pages to the maximum, and always including the same number of images, each with padded sizes. The images also need to be loaded by the browser on the same time for all pages.