The client initiates the connection and must know a key to encrypt the client hello with before the first packet. Unsigned DH is out because that would allow Mi

The client initiates the connection and must know a key to encrypt the client hello with before the first packet. Unsigned DH is out because that would allow MitM and involve another roundtrip, cached certificate is only known on the second connection and hardcoded keys would be stupid. That leaves DNS.