Draft: draft-rescorla-tls-esni

Commentary: This is a proposal to address the misrouting and key share replacement attacks identified by Ekr , Karthik , and  . Please help me improve it ! 
 Some minor nits .
Paragraph (version B):
The true SNI.
Paragraph (version B):
A random 16-octet value to be echoed by the server in the
"encrypted_server_name" extension.
Paragraph (version B):
Zero padding whose length makes the serialized struct length match
ESNIKeys.padded_length.
Paragraph (version B):
If the server does not provide an "encrypted_server_name" extension
in EncryptedExtensions, the client MUST abort the connection with an
"illegal_parameter" alert.  Moreover, it MUST check that
PaddedServerNameList.nonce matches the value of the
"encrypted_server_name" extension provided by the server, and
otherwise abort the connection with an "illegal_parameter" alert.
Paragraph (version A):
A server operating in Shared Mode uses PaddedServerNameList.sni as if
it were the "server_name" extension to finish the handshake.  It
SHOULD pad the Certificate message, via padding at the record layer,
such that its length equals the size of the largest possible
Certificate (message) covered by the same ESNI key.
Paragraph (version A):
The backend Server ignores both the "encrypted_server_name" and the
"server_name" (if any) and completes the handshake as usual.  If in
Shared Mode, the server will still know the true SNI, and can use it
for certificate selection.  In Split Mode, it may not know the true
SNI and so will generally be configured to use a single certificate.
communicating-sni describes a mechanism for communicating the true
SNI to the backend server.
Paragraph (version A):
Similar to the Shared Mode behavior, the backend server in Split Mode
SHOULD pad the Certificate message, via padding at the record layer
such that its length equals the size of the largest possible
Certificate (message) covered by the same ESNI key.
Paragraph (version B):
A server operating in Shared Mode uses PaddedServerNameList.sni as if
it were the "server_name" extension to finish the handshake.  It
SHOULD pad the Certificate message, via padding at the record layer,
such that its length equals the size of the largest possible
Certificate (message) covered by the same ESNI key.  Moreover, the
server MUST include the "encrypted_server_name" extension in
EncryptedExtensions, and the value of this extension MUST match
PaddedServerNameList.nonce.
Paragraph (version B):
In Split Mode, the backend server must know
PaddedServerNameList.nonce to echo it back in EncryptedExtensions and
complete the handshake.  communicating-sni describes one mechanism
for sending both PaddedServerNameList.sni and
PaddedServerNameList.nonce to the backend server.  Thus, backend
servers function the same as servers operating in Shared mode.
Paragraph (version A):
IANA is requested to Create an entry, encrypted_server_name(0xffce),
in the existing registry for ExtensionType (defined in RFC8446), with
"TLS 1.3" column values being set to "CH", and "Recommended" column
being set to "Yes".
Paragraph (version B):
IANA is requested to Create an entry, encrypted_server_name(0xffce),
in the existing registry for ExtensionType (defined in RFC8446), with
"TLS 1.3" column values being set to "CH, EE", and "Recommended"
column being set to "Yes".