Client Hello can be encrypted: https://support.mozilla.org/en-US/kb/understand-encrypted-cl...