I was curious about TLS1.3’s attempt to encrypt SNI, and found that it is genuinely a hard problem. The best solution seemed to be to use a proxy/fronting service, but that isn’t the ideal solution.