Hybrid KEM Integration (ML‑KEM + X25519)

Scope: introduce post‑quantum key exchange alongside a classical KEX for defense‑in‑depth during transition.

Libraries

• OpenSSL 3.x with OQS provider (liboqs)
• Prefer distro packages when available; else vendor from source with CI cache

TLS server (reverse proxy / CDN / ingress)

• Load oqsprovider at startup
• Verify TLS groups include x25519_mlkem768
• Set groups list: TLS_GROUPS="x25519_mlkem768:x25519:secp256r1"

gRPC / mTLS

• Set SSL_CTX_set1_groups_list(ctx, "x25519_mlkem768:x25519")
• Log negotiated group per handshake

Canary & Metrics

1. Staging validation (PQ‑only / classical‑only / hybrid)
2. 1% → 25% → 100% canary with rollback
3. Ship posture: success rate, p95 latency delta, payload sizes