And in practice there will almost never be other domains on the same certificate that can cloak your actions. SNI takes a bit of metadata that is basically public and makes it fully public. If you want to hide the domain you need to use another method.