It does!
webhost19:~$ sudo ip link set dev enX0 mtu 1280
…
webhost19:~$ sudo certbot renew --cert-name=webhost19.inspire.net.nz
[sudo] password for tom:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/webhost19.inspire.net.nz.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Renewing an existing certificate for webhost19.inspire.net.nz
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all renewals succeeded:
/etc/letsencrypt/live/webhost19.inspire.net.nz/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
That does not (yet) explain why other inbound HTTPS TLSv1.3 connections are working just fine, but I'll bring this to the attention of the networking-heavy side of the room now.