Current integration uses a fake QuicProofSource/Verifier in handshake: https://github.com/envoyproxy/envoy/blob/44a8588219209c4b96fca2e7e9f009138e1f3ca6/source/extensions/quic_listeners/quiche/envoy_quic_fake_proof_source.h. In ActiveQuicListener, a QuicCryptoServerConfig object is created with this.

A real EnvoyQuicProofSource should wrap FilterChainManager which can retrieve filter chain based on filter chain match. And in FilterChain object there is QuicServerTransportSocketFactory which can provides Ssl::ServerContextConfig. EnvoyQuicProofSource::GetProof() should use the ServerContextConfig to create QUIC version of certs chain and signature.

A real EnvoyQuicProofVerifier should also associate with QuicClientTransportSocketFactory and use Ssl::ClientContextConfig to verify the cert chain.