> Darn, still no host headers so we can reverse proxy on a single ip

How would this be done? After the "SSH-2.0" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a "Host" header:

* https://datatracker.ietf.org/doc/html/rfc4253#section-7.1

If we did this in SSH then I think we should do it properly and take inspiration from TLS ESNI https://datatracker.ietf.org/doc/draft-ietf-tls-esni/25/