I believe this article is talking about domain fronting, not the use of encrypted SNI. With domain fronting, you connect to one service, say, amazon.com and put

I believe this article is talking about domain fronting, not the use of encrypted SNI. With domain fronting, you connect to one service, say, amazon.com and put amazon.com in the SNI field. However, once you have a secure connection, you then tell Amazon that you really want to talk to some other website and Amazon routes the connection appropriately. To an outside observer, however, it just looks like you are talking to amazon.com and the only thing that can be done to stop this would be to block all the servers that handle that site.