> make a list of everything you can infer without a cert looking on a ssl connection

This exactly, and not just connection but connections, plural. If the network observes my encrypted connection to ocsp.apple.com followed by another encrypted connection to adobegenuine.com, an analyst could reasonably assume I'd just opened an Adobe Creative Suite app. Or if they see ocsp.apple.com followed by update.code.visualstudio.com, I probably just opened VSCode. Auto-updaters are the same kind of privacy scourge and every additional connection makes it worse.

Citations:

- https://helpx.adobe.com/enterprise/kb/network-endpoints.html

- https://code.visualstudio.com/docs/setup/network