[mumblemumble]

SNI doesn't encrypt the desired hostname in the payload of the initial connection. It's still plainly visible to an eavesdropper. They can also observe un-encrypted DNS lookups.

[skissane]

eSNI is going to fix that

https://tools.ietf.org/html/draft-ietf-tls-esni-07