🔐Cloudflare Opens Post-Quantum GeoKey Manager Beta With ML-KEM-768 Encryption

Your regional encryption keys are getting quantum-proof

Cloudflare just put its Post-Quantum GeoKey Manager into closed beta, and it's aimed at existing Data Localization Suite customers. The big move: key protection now runs on a hybrid of ML-KEM-768 and X25519, so your regional keys survive a future quantum attacker and still work with today's crypto. If you're keeping customer data pinned to specific regions for compliance, this is the part of the stack you touch when keys rotate or a region comes up. The design splits keys into regional root keys and per-service application key pairs. Application pairs are derived for a single service and a single epoch, so a leak stays contained. Root keys take a separate provisioning path through Vault, and edge servers only get them after passing hardware identity checks. The specifics: root keys are 256-bit symmetric secrets, one per region. Authorized servers load them into the kernel keyring instead of onto disk. Regional membership refreshes several times a day. Rotations come in two flavors, soft ones that keep a few previous epochs alive and hard ones that rewrap keys and cut off the old epoch. The catch? Cloudflare chose to fail closed. If regional key provisioning, sync, or rotation breaks, the region can go down entirely. Watch how the beta handles that failure mode before you trust it with production traffic, and plan for GA in Q1 2027.