[python273]

ESNI is being replaced with ECH. The certificate is encrypted in TLS 1.3.

https://blog.cloudflare.com/encrypted-client-hello/

[xg15]

Ah, that makes sense. If I understand that right, the certificate was also already encrypted in ESNI (figure 2).