Cloudflare’s regional key beta combines classical and post-quantum cryptography

Cloudflare’s post-quantum Geo Key Manager keeps regional root secrets on authorized regional servers while distributing encrypted customer keys more broadly. A hybrid construction combines ML-KEM-768 with X25519, and regional membership controls access to the secrets needed to unwrap keys. The system is in closed beta, with general availability planned for early 2027. It controls key access, rather than where all traffic is routed or inspected.

Cloudflare · Oct 23, 2026

Why it matters

Distributing encrypted material and distributing the authority to decrypt it are separate architectural decisions.

More context

Watch the beta if your key-management requirements include regional restrictions and long-lived cryptographic exposure. The design derives application keys for a region, service and epoch, and uses hardware-backed identity in provisioning. Regional Services remains a separate control for traffic processing.

Keep in mind

Failing closed when regional keys are unavailable has an availability cost. Beta access and future integrations should not be treated as generally available production capabilities.

Original read