It is required to send a sni in clear at every connection? In theory, after the first connection, you should be able to just fully encrypt the entire packet by using the certificate (public key) of the website. If that is the case, is it possible to "preload" a list of keys into the useragent to avoid having to pass the SNI in clear? I understand that is not always practical, but can it help against censorship?