TLS agility is definitely not the poster-child for a good implementation. I do not know if there is any cipher agility implementation I would really call good.

TLS agility is definitely not the poster-child for a good implementation. I do not know if there is any cipher agility implementation I would really call good. However, TLS is the prime example for why we desperately need agility anyways. Just look at the myriads of ways things broke just by trying to get TLS1.3 to work. And now imagine that totally without any agility mechanism. We would still plan for the big introduction of TLS1.3 a few years into the future.