Use an old and a new key exchange together, so an attacker has to break both.
The idea: Do both key exchanges at once and feed both shared secrets into one key derivation. The final key is safe if either exchange is: an attacker who breaks only one still faces the other's secret mixed in. It's insurance against two different failures: a future quantum computer, which breaks X25519, and a surprise attack on the much younger ML-KEM.
Why it matters: This is how browsers, SSH and Signal guard against future quantum computers today.
On the map: default in browser TLS, OpenSSH 10 and Signal (PQXDH). Breaks only if BOTH halves break
Run classical X25519 and post-quantum ML-KEM side by side and combine both secrets. An attacker has to break both: a quantum computer breaks X25519 but ML-KEM still holds, and a surprise break of ML-KEM still leaves X25519. That is the AND gate on the map[1].
It is the default today in browser TLS (X25519MLKEM768)[2], OpenSSH 10 (mlkem768x25519)[3] and Signal (PQXDH)[4].
If any of these breaks, this breaks too.
This box sits behind an AND gate: it only falls if both of these fall.
If this breaks, these break with it.