They can still check the SNI string, since initial encryption is negotiated with the proxy. They can't subsequently masquerade as the actual SNI host since the

They can still check the SNI string, since initial encryption is negotiated with the proxy. They can't subsequently masquerade as the actual SNI host since they don't have a valid cert for it, but by that point they've probably learned enough to terminate the connection and log the attempt. Well unless they have their root cert in your browser... SNI encryption is useful against ISPs and casual snooping, not state actors.