§ 01
Definition
TLS 1.3 removed the weak options that caused years of attacks on earlier versions, including RSA key transport, CBC-mode ciphers, RC4 and SHA-1 signatures. Only a handful of authenticated cipher suites remain.
§ 02
How it works
The client sends its key share in the first message, so the handshake finishes in one round trip. Every connection uses an ephemeral (EC)DHE key exchange, which gives perfect forward secrecy by default. Most of the handshake, including the server certificate, is encrypted.
§ 03
Why it matters
HTTPS sites, SSL VPNs and OpenVPN's control channel can all use TLS 1.3. Even with TLS 1.3, the website name can still leak through SNI unless Encrypted Client Hello is used, which is one reason a VPN still hides more from your ISP than HTTPS alone.