Encrypted Client Hello (ECH): what it hides and what it doesn't
How ECH encrypts the inner ClientHello, including SNI, with an HPKE key fetched from DNS, what the outer ClientHello still leaks, and where deployment actually stands now that RFC 9849 has shipped.
· 20 min read