@djb @pedromj @paulehoffman @rsalz We are discussing TLS specifically. Deployments are done by programming a list of supported key exchange algorithms, and negotiating one used by both sides. If you look at the IANA table, there are a lot of key exchanges already registered, including hybrids ECC+ML-KEM and the naked ML-KEM algorithm. All those can be deployed today, regardless of what the TLS WG does with ML-KEM draft. The discussion is about levels of endorsement and stability.