BerndPfe

The only way to actually detect is the way and how it uses the key exchange. To determine "crippled" kex use, it might be necessary to look at recurring patterns...

Another approach might be to observe a server "avoiding" to use/offer really strongest-possible curves. Or not even offering x25519 along with TLS 1.3. This would look already like a suspicious...