I have some confusion between the different public and private keys that are used in a TLS 1.3 connection. When a client makes a request to a server, I've always thought that a server's TLS x509 certificate was passed to the client and certificate was used to encrypt traffic between client and server. However, as I read more into it, it seems like the client and server generate individual public/private keys specific to the connection and that those keys are used for to bootstrap the encryption (to create a shared secret).
If my understanding of that is correct, how is the server's (CA issued) x509 certificate and key used, and when is the cert delivered to the client? Is it only used to establish the identity of the server and not used at all when encrypting the channel?
Also, a major feature of TLS 1.3 seems to be the removal of RSA for key exchange (and only support DHE and ECDHE). Does this mean that TLS certificates issued to a server can't be RSA-based, or does that "removal" only apply to what I understand as the aforementioned public/private keys that are generated on a per-session basis for the key exchange?