anchor.diff:      Options = [{max_path_length, Depth},
                  {verify_fun, ValidationFunAndState}],
       public_key:pkix_path_validation(TrustedCert, Path, Options).
  +
  +supported_groups_from_extensions(Extensions) ->
  +    case maps:get(elliptic_curves, Extensions, undefined) of
  +        #supported_groups{} = Groups->
  +            {ok, Groups};
  +        %% We do not support legacy for TLS-1.2 in TLS-1.3
  +        #elliptic_curves{} ->
  +           {error, ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)};
  +        undefined ->
  +            {ok, undefined}
  +    end.
  
positive.code: get_supported_groups(#supported_groups{supported_groups = Groups}) ->
      {ok, Groups}.
  
  get_key_shares(#key_share_client_hello{client_shares = ClientShares}) ->
      ClientShares;
  get_key_shares(#key_share_server_hello{server_share = ServerShare}) ->
  
negative.code:                                 honor_cipher_order := HonorCipherOrder,
                                  early_data := EarlyDataEnabled}} = State0) ->
      SNI = maps:get(sni, Extensions, undefined),
      EarlyDataIndication = maps:get(early_data, Extensions, undefined),
      {Ref,Maybe} = maybe(),
      try
          ClientGroups0 = Maybe(supported_groups_from_extensions(Extensions)),
          ClientGroups = Maybe(get_supported_groups(ClientGroups0)),
          ServerGroups = Maybe(get_supported_groups(ServerGroups0)),
          
  