Cloudflare’s new PQ GeoKey Manager: keys that can only unwrap inside a chosen region, wrapped with hybrid ML-KEM + X25519

I spent the week pulling apart Cloudflare’s PQ GeoKey Manager announcement (Oct 23, closed beta, GA planned Q1 2027) and wrote up how the mechanism actually works, with a simulator you can break. The part I found most interesting: the wrapped key travels everywhere on the network, but the regional root key never does. It only reaches authorized edge servers through a separate provisioning path, and on those servers it lives in volatile kernel keyring memory. A request that lands in the wrong region fails closed instead of rerouting somewhere helpful. The wrapping is hybrid HPKE: ML-KEM-768 plus X25519, so it holds as long as either one holds. The part I’m still unsure about: a ‘region’ here is a living inventory list that changes several times a day, not a fixed line on a map. That makes the audit question interesting. Original announcement: https://blog.cloudflare.com/post-quantum-geo-key-manager/ My writeup with the interactive key-check simulator: https://movahedi.ca/insights/post-quantum-geo-key-manager/ (a French version is on the same site too) submitted by /u/masiha97 [link] [comments]Technical Information Security Content & DiscussionRead More