Currently before establishing an encrypted connection to a webserver the domain is sent to the webserver unencrypted so that the server can choose the appropriate certificate to use for encryption. That is called SNI, Server Name Indication.

Of course that’s a privacy risk. There are finally protocols to fix this but they aren’t very widespread and depend on DNS over HTTPS.

I think issuing certificates based on the IP and sending the domain name encrypted based on that certificate could have fixed this issue ages ago.