Thanks Crypto4Lib for Pascal or SecureBridge could be a good idea to test with. I'm not so happy with OpenSSL as it's fine for some
OS but not for all.
Good choice, i also not a fan of OpenSSL,
One thing though, i put SecureBridge without completely being sure if you can do it easily or not, i don't have it, but if they say it does TLS 1.3 then for sure it can do HKDF and ECDH, be sure that these functionality are within exposed classes before you buy if you are not getting the license with full source.