Aux armes, citoyens,
Formez vos bataillons,
Marchez, marchez !
Qu’un sang impur
Abreuve nos sillons !

I see a familiar pattern. First block internet resources, then block VPN, then build your own isolated internet…

@mouse@midwest.social, @ferric_carcinization@lemmy.ml, thank you for the help and the links — things are a bit clearer now.

As I understand it, SNI slicing helps obscure the presence of the SNI field in the TLS ClientHello by splitting it into two chunks. The idea, it seems, is to make it more difficult for third-party network filters or DPI systems to detect or extract the SNI reliably.