How to properly deploy ECH in transparent proxy mode

I have a TLS transparent proxy which works like this:

```
Client ==|TLS request|==> Proxy ==|HTTP Connect|==> Target
```
I use https://github.com/inconshreveable/go-vhost to sniff SNI and construct the HTTP Connect request to the target site.

Now I want to add ECH support to my transparent proxy. But I stuck after getting the inner SNI:

```
tlsConn, _ := vhost.TLS(conn)
sconn := tls.Server(tlsConn, &tls.Config{
ECHEnabled: true,
ServerECHProvider: echProvider,
Certificates: []tls.Certificate{cert},
})
sconn.Handshake()
sconn.ConnectionState().Servername // This is the inner SNI
```

IIUC, the proxy must tell the client to construct the new inner ClientHello, how can I archive that with the current crypto/tls API?

cc @cjpatton