Show HN: Sebel – Block certificates used by botnet C&C servers

What would be the use cases for this client library?

I was expecting a pcap library that would try to catch server side certificates from tls handshake and block them with nflink or something, however not sure if serverhello is encrypted or not.