An eavesdropper would already be able to see this in the sni information. SNI is even more accurate, because things like cloudflare certs are often for 100s of

An eavesdropper would already be able to see this in the sni information. SNI is even more accurate, because things like cloudflare certs are often for 100s of different domains with many wildcards. eSNI has not really taken off yet, so almost always your requests are saying the exact domain you are going to in clear text. However, the bit about the CAs getting some analytics about certs they issue is valid.