Don't negotiate TLSv1.3 if our EC cert isn't TLSv1.3 capable