Various reasons. Here's a technical one: a redirect gets you one more HTTP roundtrip (and perhaps one more TCP roundtrip, and/or one more HTTPS handshake, and/o

Various reasons. Here's a technical one: a redirect gets you one more HTTP roundtrip (and perhaps one more TCP roundtrip, and/or one more HTTPS handshake, and/or one more DNS lookup). In other words: this is simple on server-side but slooooooow and brittle on client-side. As for the scenario "couldn't the censor send a redirect?" - no. Unless the user trusts the censor's CA (Etilasat or eDellRoot comes to mind), the censor doesn't see inside the HTTPS tunnel, only that it exists to an IP address (looked up by a previous DNS request).