I don't follow. The TLS handshake negotiates the appropriate ciphersuite. With the exception of dropping SHA1 in TLSv1.3, how was the macOS SSL module not able to negotiate a handshake? There should be plenty of suites available. What did Darksky ask for in the TLS handshake???
For example: I'm still running Mojave, and here's what I see from the handshake with the Darksky.net site on :443 ...
:
:
issuer=C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5538 bytes and written 439 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 :
:
:
They aren't even using TLS1.3 on the main page.