> If this was true, TLS 1.3 would have RSA kex. I hope you're right... > In practice the intention is that ECH will be GREASEd If even fake ECH extensions ge

> If this was true, TLS 1.3 would have RSA kex. I hope you're right... > In practice the intention is that ECH will be GREASEd If even fake ECH extensions get rejected, then it's hard to deploy the whole GREASy burrito. > China can decide its own policies without help from us. ... but China can make it uncomfortable to support ECH worldwide. It's not a free action for a service to risk being blocked in China, or for client software to accept being unreliable or unusable in China. That affects deployment in the rest of the world. We'll see who wins the war of wills, but I'm afraid that the "Western" entities that have the most control over what's widely deployed are not going to have will enough.