Why is my ALB not speaking TLS v1.1 even though I'm using a security policy which allows it?

I'm having the weirdest problem. I have an ALB that is configured to use "ELBSecurityPolicy-2016-08", which according to this chart should support TLS v1.0, 1.1, and 1.2. I have a Java 7 client (which apparently doesn't speak TLS v1.2) that needs to talk to this ALB over HTTPS. I've quadruple-checked that my ALB is running that policy and the change was made several hours ago. If I use curl or openssl to try and speak to my ALB and force TLS 1.0 or 1.1 it fails:

$ curl -vvvvv -k --tlsv1.1 --tls-max 1.1 https://myappname-XXXXXXXXXX.us-east-1.elb.amazonaws.com/myappname/api/v1.0/authentications
*   Trying xx.xx.xx.xx:443...
* TCP_NODELAY set
* Connected to myappname-alb-prod-dca-tf13-new-XXXXXXXXXXXX.us-east-1.elb.amazonaws.com (xx.xx.xx.xx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS alert, internal error (592):
* error:141E70BF:SSL routines:tls_construct_client_hello:no protocols available
* Closing connection 0
curl: (35) error:141E70BF:SSL routines:tls_construct_client_hello:no protocols available


$ openssl s_client -connect myappname.mycompany.com:443 -tls1_1
CONNECTED(00000003)
140196835726656:error:141E70BF:SSL routines:tls_construct_client_hello:no protocols available:../ssl/statem/statem_clnt.c:1112:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 7 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

I've even tried setting it to an older policy and the results are the same:

$ aws elbv2 describe-listeners --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:XXXXXXXXXXX:loadbalancer/app/myappname/XXXXXXXXXXX
{
    "Listeners": [
        {
            "ListenerArn": "arn:aws:elasticloadbalancing:us-east-1:XXXXXXXXXXX:listener/app/myappname/XXXXXXXXXXX/XXXXXXXXXXX",
            "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:XXXXXXXXXXX:loadbalancer/app/myappname/XXXXXXXXXXX",
            "Port": 443,
            "Protocol": "HTTPS",
            "Certificates": [
                {
                    "CertificateArn": "arn:aws:acm:us-east-1:XXXXXXXXXXX:certificate/XXXXXXXXXXX"
                }
            ],
            "SslPolicy": "ELBSecurityPolicy-TLS-1-0-2015-04",

The target group that the ALB uses is speaking SSL to the backend instances, but I read that "The ELBSecurityPolicy-2016-08 security policy is always used for backend connections". Does anyone have any idea why this ALB won't speak TLS 1.0 or 1.1 even though it has a policy that allows it to?