Ah, that makes sense. If I understand that right, the certificate was also already encrypted in ESNI (figure 2).