in case i cannot do PSK (give the same key to both sides via physical means). i saw tls1.3 still support DH (doesnt matter that it is DHE or ECDH). isnt that makes it a weak key exchange? do they rely on seperate key exchange algo.? (like PAK - x.1035)
TLS 1.3 without PSK (i.e. the usual use-case of TLS) uses a certificate which verifies the authenticity of the service, just like all the other versions of TLS (and SSL). For most typical uses in web browsers, the server's certificate is signed by a certificate authority (CA). It doesn't matter what key exchange algorithm is used as long as it is strong (DH and ECDH are considered strong).
See also The New Illustrated TLS Connection: Every byte explained and reproduced for TLS 1.3.