Cloudflare launches closed beta for post-quantum regional key management

Cloudflare announced a closed beta of its post-quantum GeoKey Manager on October 23, adding new cryptography to geographically restricted key management for its Data Localization Suite. The company plans general availability for Q1 2027. Its design combines ML-KEM-768 and X25519 to protect wrapped private keys while retaining regional restrictions on their use.

The intended audience includes organizations whose sensitive data must remain protected for years while meeting geographic processing requirements. Cloudflare says the design addresses harvest now, decrypt later attacks, where adversaries retain ciphertext for future quantum decryption. Wrapped keys can travel globally; the regional root keys needed to unwrap them have a much shorter travel itinerary.

The boundaries deserve attention: GeoKey Manager controls key unwrapping, while separate systems govern routing, tunnel termination, and traffic inspection. Cloudflare says requests fail closed when required checks fail. Integration with its existing CDN geographic key controls remains under development; current DLS customers regionalizing CDN traffic can register interest in testing before CDN general availability.