> For example TLS with client certificates (the client's certificate gets sent encrypted to the server).

Hmm... I was under the impression that up until TLS 1.3 the client cert was sent in the clear during session negotiation...