By asahifile 
Two numbers sit next to each other on Cloudflare’s post-quantum dashboard, and almost nobody reads them together. About 70% of browser-generated traffic reaching Cloudflare’s network is already protected with hybrid ML-KEM key agreement, the company said in a 29 September post that added per-domain visibility. On the other hop — from Cloudflare out to the customer’s own origin server — the figure is about 15%.
Two hops, and two different denominators
The 70% is a share of requests; the 15% is a share of origins, and Cloudflare says so explicitly, so the pair is not one measurement. But they are the only pair anyone publishes, and the direction is unambiguous. The browser half was solved by defaults — Chrome, Firefox and Apple turned hybrid key agreement on. The server half was not: nobody can push a default onto a million origins configured years ago.
The multiplication nobody prints
A request is protected end to end only if both hops are post-quantum. Assume the two shares are independent and multiply: 0.70 × 0.15 = 0.105, or roughly 10.5% of request paths. That assumption flatters the result — origins supporting ML-KEM cluster behind modern proxies, so the joint share is likely a little higher — but the corollary holds regardless: 85% of the second hop is classical, and that hop is where data sits at rest.
Harvest-now-decrypt-later needs exactly one classical hop: a recording taken behind a post-quantum front door and in front of a classical origin is as readable later as any other.
Fifty months, 1.7 points a month
Executive Order 14412, signed on 22 June 2026, requires federal high-value and high-impact systems to reach post-quantum key establishment by 31 December 2030 — 1,514 days, or 49.7 months, from today. Lifting origins from 15% to 100% inside that window needs 1.71 points a month, sustained.
For scale, the browser side travelled roughly 0 to 70 points in about two years — under 3 points a month — so origins need about 59% of that pace. Cloudflare describes origin support growing from roughly half a percent to about 13%, with no dates attached, which is the tell. The deadline binds federal agencies and their contractors, not anyone’s origin rack.
Why the origin is the hard part
The maths is not the obstacle. X25519MLKEM768 grows the TLS 1.3 key share from 32 bytes to around 1,200 bytes, a 37.5-fold jump your middleboxes also have to parse. In 2023 Cloudflare measured 0.34% of origins breaking on large ClientHellos — a fraction that still means thousands of servers. Leading classical-first cost a hello retry on 52% of TLS 1.3 origin connections; after switching to post-quantum-first, gated by a daily scan, retries fell to 3.7% and post-quantum origin traffic rose from about 25 billion to 45 billion connections a day.
Six years between the tightest and loosest deadline
Line the published dates up and one cryptographic asset gets five different answers: France’s ANSSI stops certifying products without quantum-safe cryptography in 2027; India, Google and Cloudflare have named 2029; the US order sets 2030 for encryption and 2031 for signatures; Microsoft chose 2033; NIST deprecates RSA and elliptic curve after 2030 and disallows them after 2035, the date Canada, Japan and the UK have adopted.
The contradiction inside the US position is worth stating plainly. One extra year for signatures implies the government thinks a cryptographically relevant quantum computer is plausible around 2031; simultaneously, NIST permits RSA until 2035. An organisation can meet the loosest deadline and sit six years behind the tightest.
For a Japanese operator on the 2035 track, the encryption cut-off arrives five years before the headline, and today’s archive sits 9.1 years out — inside the harvest window for the ten-year records that dominate medical and financial data here.
The hardware estimates move one way. Google and the Ethereum Foundation put secp256k1 at under 500,000 physical qubits and nine minutes; IonQ says 20,000 qubits and 26 days, with a 10,000-qubit machine due in 2027; Oratomic claims 10,000 qubits in a few days. A 50-fold spread on one class of problem, though the tasks differ — and Iceberg Quantum’s RSA-2048 estimate fell from 98,000 qubits and a month to 72,000 and 3.7 days.
What to watch
- The Radar origin share: does it clear 30% before the 2027 procurement rules bite?
- An origin adoption curve with dates. That missing x-axis is why 2030 still looks comfortable.
- ML-DSA certificates and Merkle Tree Certificates before the 2031 signature cliff.
- Japan’s own inventory and migration documents, which currently inherit the 2035 headline.
- IonQ’s 10,000-qubit system in 2027, the first hardware check on that estimate.
Sources: Cloudflare, post-quantum visibility, Cloudflare on Executive Order 14412, Cloudflare Connect 2026 session, EE Times, Infosecurity Magazine. Figures are the sources’ own; the end-to-end share and the required monthly pace are this site’s arithmetic.