Keyless SSL supports TLS 1.3 with ECDSA certificates
Keyless SSL supports TLS 1.3 for ECDSA certificates. When TLS 1.3 is enabled on your zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate negotiate TLS 1.3, and your private keys stay on your own key server.
Keyless SSL connections that use RSA certificates continue to negotiate up to TLS 1.2.
For details, refer to the Keyless SSL limitations.