New version of OpenSSL, the 3.5, supports a new syntax for specifying which of the advertised/supported key exchange groups should be sent in the ClientHello.key_share extension.

If the new syntax is not used, only the very first group in the list will be included in key_share. Since we will have a post-quantum policy in RHEL-9.7 that enables a hybrid post-quantum groups as highest priority, that will mean that all connections to servers supporting only classic algorithms (X25519, P-256, etc.) will end up with increased latency for the connection (because of HelloRetryRequest mechanism).

Crypto-policies should allow specifying which of the key exchange groups should be included in the key_share extension.