But that's SNI's fault specifically. For comparison, SSH doesn't do that (to my knowledge at least), but the attacker can still see the destination IP, and migh

But that's SNI's fault specifically. For comparison, SSH doesn't do that (to my knowledge at least), but the attacker can still see the destination IP, and might well be able to map that back to the domain. I agree though that ideally a bad guy intercepting your traffic should not be able to tell where it is headed.