to encourage others.. wpa3 for me was install of one package (opkg install --force-overwrite hostapd-openssl) and changing one config line (encryption = 'sae'). Client had no issue connecting (wpa_supplicant 2.9 on ubuntu 19.10, though only nmcli shows the connection as wpa3). The various dragonblood attacks are mitigated in current hostapd if I'm not mistaken.