Comment by hellfish

> so the SNI and Host header already gives it away, TLS or not

Couldn't you just use ech/esni, ISP wouldn't see the domain only IP (and dns provider)?