bearSSL is somewhat unmaintained and may never reach tls 1.3. Additionally it's not available on most distros.
options: