Hmmmm I really don't think the best option is to make TLS-SNI-3 STILL working on the basis of providing the wrong Host header/SNI hostname. Let's make TLS-ALPN

Hmmmm I really don't think the best option is to make TLS-SNI-3 STILL working on the basis of providing the wrong Host header/SNI hostname. Let's make TLS-ALPN-1, have the protocol as "acme-verify", and respond with a simple custom protocol - ignoring HTTP.