I remember reading an article once where they said SIP sends the hash of the application in the clear. This allows your ISP to track known application hashes you have installed. Unsure if this is still accurate.
It does, but it is the hash of the developer’s certificate. For most developers, this uniquely identifies the single application they publish. If you launch a unique constellation of apps then it uniquely identifies your machine.
Apple committed to sending this OCSP check not in plaintext within a year, but that was more than a year ago.
This part has been accomplished.
However, Apple has reneged on the opt out user preference.