Secure remote login to servers.
The idea: When you connect, client and server do a key exchange (OpenSSH 10 defaults to ML-KEM combined with X25519), the server proves its identity by signing with its host key, and you log in by proving with a signature that you hold your private key, usually Ed25519. The session is then protected with authenticated encryption. The "fingerprint" prompt on first connection is SSH asking you to trust the server's host key.
Why it matters: How developers and admins manage most of the internet's machines.
On the map: hybrid KEM + Ed25519 keys + ChaCha20-Poly1305 falls if ANY part falls
Remote login and file transfer[1]. OpenSSH 10 (2025) defaults to the mlkem768x25519 hybrid key exchange[2, 3] (OpenSSH 9.0 already defaulted to a different hybrid, sntrup761x25519, in 2022)[4], Ed25519 host and user keys, and ChaCha20-Poly1305 or AES-GCM for traffic.
Breaking the signature keys allows impersonation. Breaking the key exchange halves alone doesn't.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.