Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search.

https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options

http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...

If someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)