Finally got ECH working in both Firefox and Brave without breaking lokinet. Huge thanks to jedisct1 for https://github.com/DNSCrypt/doh-server. Now I have a local DoH resolver that connects to my local dnsmasq instance.

You can test for ECH support at https://defo.ie/ech-check.php.

Security and privacy should always be a priority!

If you want to learn more about the ECH rollout, Cloudflare has a great writeup at https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/.