&gt; I&#x27;m not sure how much hiding the SNI would get you in terms of privacy. You could always just look at the destination IP address of the packet.<p>Destination IP will be the same for all sites on the server, SNI tells you exactly which site was asked for. Not meaning to be pedantic, sometimes the distinction isn&#x27;t clear.<p>But in order to encrypt the SNI name, you&#x27;d first need to verify a certificate tied to a bare IP address. You&#x27;d also need to trust DNS completely. RTT would inflate significantly.<p>The CA system is a mess, but DNS is worse. Tying certs to bare IPs would create a deployment nightmare as well.<p>SNI is imperfect, but it is a big improvement over the previous status quo, which was single-IP per https host, which obviously did nothing to obscure the site hostname either.