Pretty sure this isn't possible?? There must be some way to use a hash of the clientHello later in the key exchange process to make sure the connection fails if the hello is tampered with...?