If we did this in SSH then I think we should do it properly and take inspiration from TLS ESNI https://datatracker.ietf.org/doc/draft-ietf-tls-esni/25/