How does a TLS handshake work (TLS 1.3)?

The client sends ClientHello with supported ciphers and a key share. The server replies with ServerHello, its key share, certificate and a signature proving it holds the private key. Both derive session keys from the (EC)DHE exchange, giving forward secrecy, and switch to symmetric encryption after one round trip.