Here's a build of netsurf 3.9 based on a backport of openssl 1.1 (from buster), that should support TLS 1.3 (see screenshot*):

https://transfer.sh/PEg06/netsurf-3....ed_sulu.tar.gz **
Building netsurf was easy, but of course I also needed to backport openssl. That wasn't too hard either, but it has a side effect:
netsurf uses curl as a backend, and you need your netsurf and curl to use the same openssl version. So I had to backport curl as well, which was a bit tricky, because autoconf had introduced a new option called "runstatedir" in the meantime. I neeed to patch that option out of the source package.

As a consequence the archive linked above contains these packages:
You'll need to install all of them.*** The libcurl4 package might cause some trouble though. Vanilla Jessie has libcurl3, which libcurl4 conflicts with.**** I added the "Provides: libcurl3" tag to my libcurl4 package, so from a formal POV the change in name shouldn't cause any trouble as long as another program doesn't require a specific version of libcurl3.
But the truth is, I don't know what will actually happen. This libcurl4 package has the potential to break ANY other program that uses curl.*****

For completeness, here's another archive that includes all the packages I backported during this build:

https://transfer.sh/tGxRo/netsurf-3....ackages.tar.gz


*) Whoever decided to make Ctrl + Shift + P the screenshot hotkey deserves to be tarred and feathered! How am I supposed to hit those three keys without breaking my fingers?
**) Since zippyshare has blocked users from some parts of the world (including Germany), I needed to find another file host.
transfer.sh looks kind of nice, but they seem to delete files after 14 days if I got that correctly.
***) Strictly spoken, you don't need netsurf_3.9-1_all.deb at all.
****) In parts, they ship the same files.
*****) Which you might not even be aware of, because it's happening in the background.******
******) These stars are getting out of hand.