Exactly. Send the actual payload, then junk to other people. To facilitate, the junk could even be flagged (in the encrypted payload) as such so the recipients’ client software knows to ignore it.

Also fine to send junk to sock puppets. Have the sock puppets send junk back, and amongst themselves, etc.

The reason the metadata attack works right now is because all messages are signal. Drowning that signal in noise would not be difficult, in principle.