Some providers ban TLS 1.3 completely, not just connections using ECH. Could you consider adding server option to explicitly choose TLS version?