As well as SNI, most reverse proxies need to know which TLS cert to serve. Lower than layer 7.