[TurningCanadian]

There's still TLS Server Name Indication leaking the hostname.

[manigandham]

SNI can be encrypted in an extension of TLS 1.3 called ESNI (encrypted server name indication). With both EDNS and ESNI, there's sufficient privacy coverage.

The next standard is ECH (encrypted client-hello) which secures the entire handshake: https://blog.cloudflare.com/encrypted-client-hello/

[gsich]

Is it still in draft state?

[manigandham]

Yes: https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-15