Or, at least, that’s how it would work if it wasn’t for SNI…

Cloud Flare supports ECH. https://developers.cloudflare.com/ssl/edge-certificates/ech/

China blocks ECH.

do you have a reliable source for this claim?

China's use of SNI-based censorship is well-documented

For example, see

https://censorbib.nymity.ch/pdf/Niere2025a.pdf

Yes, but SNI is not ECH.

China has blocked ESNI

https://gfw.report/blog/gfw_esni_blocking/en/

But SNI is not CH and ESNI is not ECH

Will China block ECH

ECH blocking has been detected in Russia

https://github.com/net4people/bbs/issues/417

According to Niere et al. (2025)

"Additionally, with the ECH extension not yet being widely used [17], [71] and focusing on privacy protection rather than censorship circumvention [60], it can be censored easily by blocking it entirely [14], [76]."

The paper describes various GFW bypass methods that currently work, including removing the SNI extension entirely

It does not mention anyone using ECH to bypass GFW

Perhaps it is too early to conclude "China blocks ECH" because ECH is not in widespread use

Any examples of Cloudflare client websites that have enabled ECH

It's funny that the original idea for HTTPS was that there should be private communication between clients and service providers, and it somehow got turned on its head and now its just private communication between you and Cloudflare, and they can see all the traffic.

We talk about end to end encryption all the time, but half the web is hosted by a single company with questionable ethics and everyone is like, we trust them! They write technical blog posts!

Even Signal is hosted on Cloudflare...

Great gaslighting I must admit, terminating SSL of half the internet.. that centralization is actually enhancing privacy... There is a very high probability Cloudflare is a literal NSA front.

I don't see how that's gas lighting?

I'm just suggesting that there are trade-offs involved and value gained by making private origin servers common.