@jzb @rsalz @darkuncle Side note re "crypto expert": The issue here is basic security risk management. For example, Google and Cloudflare tried ECC+SIKE (CECPQ2b: https://web.archive.org/web/20260411125124/https://blog.cloudflare.com/the-tls-post-quantum-experiment/) for tens of millions of user connections, and then SIKE was publicly broken years later. The only reason this didn't immediately expose all those user connections to attackers is that the connections were still encrypted with ECC.