I thought that certificates for IP addresses would be a better way to use encrypted SNI rather than DNS hackery. Like onion routing (tor) or extended authentica

I thought that certificates for IP addresses would be a better way to use encrypted SNI rather than DNS hackery. Like onion routing (tor) or extended authentication protocol (EAP) with its outer and inner identities, I envisage the browser would first initiate a TLS connection to the IP address and then initiate a TLS connection to the domain name within the outer TLS connection.