Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%

Cloudflare’s Automatic Key Exchange (AKE) replaces the default X25519 guess with a probe that selects the origin’s preferred key-agreement algorithm, favoring the post-quantum hybrid X25519MLKEM768 when supported. This change dropped HelloRetryRequests from 52% to 3.7%, cutting more than 150 ms off handshake latency at the 90th percentile. As a result, hundreds of thousands of domains now have post-quantum origin connections without manual configuration, advancing Cloudflare’s goal of full quantum-secure traffic by 2029.