This article gives an implementation of encrypted SNI where a public key is retrieved from the DNS. It feels like cheating but imagine this: If the server publishes its certificate on its DNS record, shouldn't the client be able to send encrypted data (since it has fetched server protocol, public key, etc. from DNS record) in the very first packet, without TLS handshakes, and thus making HTTPS 0-RTT (instead of 1-RTT with TLS 1.3) even for new connections? In a word, the DNS now contain richer information than a plain domain name to ip address mapping, to help with TLS handshake.
Any security problems with this scenario?