GP means unencrypted at the wire level. ClientHelloOuter is still unencrypted even with HSTS.

[deleted]