This protects only against an attacker who has broken AES so thoroughly that they can essentially surveil TLS traffic en masse at no cost.

To a targeted attacker, TLS is trivially identifiable through packet analysis. After a few handshakes, your transform (as mentioned elsewhere, reverse some nybbles and XOR against a constant) will be fully understood and broken with likely less effort than it cost you to build in the first place.