standard
Hybrid TLS 1.3 key agreement mechanism defined in a current IETF draft, combining X25519 with ML-KEM-768 and using a 1,216-byte client key exchange value.
No evidence-backed relationships are recorded.
Cloudflare reports origin handshake retries falling by a factor of fourteen, though its own 30% miss rate cannot produce a 52% baseline. What does transfer is post-quantum key agreement arriving with nobody configuring it.
Reality
AWS and Microsoft are already shipping ML-KEM hybrid groups, so the question for platform teams is whether the old proxy, SDK and appliance in the path still complete a handshake that got bigger.
Reality
Probing each origin for its preferred key agreement group dropped HelloRetryRequests on scanned origins from about 52% to 3.7% and took more than 150 ms off p90 handshakes, after the price of the old classical-first default had climbed 25-fold since 2023.
Reality
The non-LTS release is mostly two years of JDK 25 experiments switched on by default, and the flipped defaults change memory and handshake behaviour in small containers rather than adding syntax anyone will write.
Reality
X25519MLKEM768 leaves the TLS application surface alone and moves the cost into handshake bytes. The work now is knowing which group each connection actually negotiated.
Reality