I've written a proxy that uses SNI to filter outgoing connections based on the domain name, without decrypting the traffic. It's not exactly user-friendly as you'd like, but it's a good solution to our use-case.
I might open-source it if there's interest but it's relatively basic.
I might open-source it if there's interest but it's relatively basic.