X448 is a perfect replacement for secp521r1 to gain "level 8" security here: https://www.keylength.com/en/3/

RFC8080: Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC

btls has both, but no TLS 1.3.