> now they need to try every possible private key to see if they can open our encrypted SNI. The idea was to have a single common introductory keypair which al

> now they need to try every possible private key to see if they can open our encrypted SNI. The idea was to have a single common introductory keypair which all tenants publish to their DNS, in order to encrypt the SNI. That way there is no need to try multiple private keys. The lack of DNSSEC deployment is an issue, although there's nothing to stop such schemes being employed on an opportunistic basis. However, when DNSSEC is available for a domain, the scheme should be enforced to prevent a MITM attack.