The solution is to do as most goverments do [0]: sniff the SNI header during TLS handshakes and drop the connection if the domain matches your blocklist(s)//reg

The solution is to do as most goverments do [0]: sniff the SNI header during TLS handshakes and drop the connection if the domain matches your blocklist(s)//regex filters. [0] https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/