{"id":"042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456","title":"Cloudflare: Bringing post-quantum cryptography to geographically fenced key management","argument":"Cloudflare says its post-quantum GeoKey Manager has entered closed beta as part of its Data Localization Suite. The company frames the change around a risk to sensitive data: attackers could store encrypted data now and try to decrypt it later with quantum computers, an attack strategy called “harvest now, decrypt later.”\n\nThe system is designed to restrict where customer private keys can be unwrapped while allowing wrapped keys to be distributed across Cloudflare’s network. Cloudflare describes using regional root keys and application-specific key pairs, with hybrid ML-KEM-768 and X25519 protection. It says edge servers receive regional root keys only when authorized for that region, and requests fail closed if required keys or checks are missing. The design rejects requests rather than unwrapping a key outside its allowed region.\n\nGeoKey Manager addresses one part of data sovereignty: where keys can be used to decrypt data. Cloudflare says it does not control where requests are routed, tunnels terminate, or traffic is inspected. The post also describes an operational tradeoff: keys held in volatile memory must be provisioned again after a server restart.\n\nCloudflare says general availability is planned for Q1 2027, and a separate integration for its existing CDN capability is in development.","topicIds":["power-and-infrastructure","institutions-and-trust"],"domain":"infrastructure","claimType":"attributed reading","limits":"The feature is in closed beta; Cloudflare says general availability is planned for Q1 2027. Cloudflare says the system does not control request routing, tunnel termination, or traffic inspection. The post describes Cloudflare’s design and claims; it does not provide independent testing results or establish operational performance.","speaker":{"name":"Cloudflare","roleAtSource":"Publisher"},"source":{"title":"Bringing post-quantum cryptography to geographically fenced key management","publisher":"Cloudflare Blog","format":"Article","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","publishedAt":"2026-10-23T18:06:56.089Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Cloudflare says the post-quantum GeoKey Manager has launched in closed beta as part of its Data Localization Suite.","excerpt":"Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says the design uses hybrid ML-KEM-768 and X25519 protection, with regional root keys and application-specific key pairs.","excerpt":"Cloudflare therefore uses hybrid ML-KEM-768 and X25519 protection with two kinds of keys","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says edge servers receive only regional root keys authorized for their location, and requests are rejected when required checks fail.","excerpt":"if any required check fails (service context, region, epoch, etc.), the request is rejected.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says GeoKey Manager controls where wrapped private keys can be unwrapped, but not request routing, tunnel termination, or traffic inspection.","excerpt":"GeoKey Manager controls where wrapped private keys can be unwrapped and used on the data plane. It does not control where requests are forwarded or routed","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says general availability is planned for Q1 2027 and a separate integration with its existing CDN capability is in development.","excerpt":"While general availability (GA) is planned for Q1 2027","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"The described design appears intended to limit exposure from stored ciphertext while preserving geographic restrictions on key use; this is an interpretation of Cloudflare’s stated aims.","excerpt":"This protects private-key material against harvest now, decrypt later while preserving regional key-use boundaries.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","checkedAt":"2026-10-24T20:01:05.091Z","items":[{"type":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","attribution":"Cloudflare Blog","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-10-24T20:01:05.695Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How will Cloudflare validate that regional key access remains restricted as its server locations and regional memberships change?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Cloudflare: Bringing post-quantum cryptography to geographically fenced key management","summary":"Cloudflare says its post-quantum GeoKey Manager has entered closed beta as part of its Data Localization Suite. The company frames the change around a risk to sensitive data: attackers could store encrypted data now and try to decrypt it later with quantum computers, an attack strategy called “harvest now, decrypt later.”\n\nThe system is designed to restrict where customer private keys can be unwrapped while allowing wrapped keys to be distributed across Cloudflare’s network. Cloudflare describes using regional root keys and application-specific key pairs, with hybrid ML-KEM-768 and X25519 protection. It says edge servers receive regional root keys only when authorized for that region, and requests fail closed if required keys or checks are missing. The design rejects requests rather than unwrapping a key outside its allowed region.\n\nGeoKey Manager addresses one part of data sovereignty: where keys can be used to decrypt data. Cloudflare says it does not control where requests are routed, tunnels terminate, or traffic is inspected. The post also describes an operational tradeoff: keys held in volatile memory must be provisioned again after a server restart.\n\nCloudflare says general availability is planned for Q1 2027, and a separate integration for its existing CDN capability is in development.","question":"How will Cloudflare validate that regional key access remains restricted as its server locations and regional memberships change?","claims":[{"text":"Cloudflare says the post-quantum GeoKey Manager has launched in closed beta as part of its Data Localization Suite.","excerpt":"Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta.","support":"source-stated"},{"text":"Cloudflare says the design uses hybrid ML-KEM-768 and X25519 protection, with regional root keys and application-specific key pairs.","excerpt":"Cloudflare therefore uses hybrid ML-KEM-768 and X25519 protection with two kinds of keys","support":"source-stated"},{"text":"Cloudflare says edge servers receive only regional root keys authorized for their location, and requests are rejected when required checks fail.","excerpt":"if any required check fails (service context, region, epoch, etc.), the request is rejected.","support":"source-stated"},{"text":"Cloudflare says GeoKey Manager controls where wrapped private keys can be unwrapped, but not request routing, tunnel termination, or traffic inspection.","excerpt":"GeoKey Manager controls where wrapped private keys can be unwrapped and used on the data plane. It does not control where requests are forwarded or routed","support":"source-stated"},{"text":"Cloudflare says general availability is planned for Q1 2027 and a separate integration with its existing CDN capability is in development.","excerpt":"While general availability (GA) is planned for Q1 2027","support":"source-stated"},{"text":"The described design appears intended to limit exposure from stored ciphertext while preserving geographic restrictions on key use; this is an interpretation of Cloudflare’s stated aims.","excerpt":"This protects private-key material against harvest now, decrypt later while preserving regional key-use boundaries.","support":"interpretation"}],"limitations":["The feature is in closed beta; Cloudflare says general availability is planned for Q1 2027.","Cloudflare says the system does not control request routing, tunnel termination, or traffic inspection.","The post describes Cloudflare’s design and claims; it does not provide independent testing results or establish operational performance."],"mediaId":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","correctionReason":null,"id":"042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456","publicationId":"591a114d-8c62-4608-8b98-f435634dc04b","version":1,"sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","sourceTitle":"Bringing post-quantum cryptography to geographically fenced key management","publisher":"Cloudflare","publishedAt":"2026-10-23T18:06:56.089Z","originalPublished":{"value":"2026-10-23T18:06:56.089Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-23T18:11:14.076Z","createdAt":"2026-11-14T08:48:52.513Z","historical":true,"entityIds":["cloudflare"],"topicIds":["power-and-infrastructure","institutions-and-trust"],"media":[{"id":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","kind":"article","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-24T20:01:05.695Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"4048b5751f67e45e9e8c64ff49cffc753a44828040994135f814187eec913f72","kind":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","label":"View source image","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-24T20:01:05.695Z","method":"publisher_association_and_head","contentType":"image/webp","cacheUntil":1792872065695},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","checkedAt":"2026-10-24T20:01:05.091Z","items":[{"type":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","attribution":"Cloudflare Blog","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-10-24T20:01:05.695Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","confidence":0.91,"provider":"vercel","model":"typesafe-ai/jev","inputHash":"144bca9c48dd64c253f6c68c042c3a3f82ca53377f47c6669280d5da0c215153","decidedAt":"2026-10-24T20:01:07.496Z"},"provenance":{"textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observationId":"009194d8083aa683b4c1b5c6d30f4915e7e64b5089b72ffa2b0e87910e4ff488","retrievedAt":"2026-10-24T20:01:05.091Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"a7e83da1-80ad-409a-8708-0393ff376ab4"},"reviewer":{"model":"gpt-6-luna","runId":"4250ac64-935b-4e30-85be-fff437f21bbc"}},"audit":{"status":"passed","reviewedAt":"2026-11-14T08:48:52.513Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[],"authorRole":"article-author","hosts":[],"status":"missing","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cloudflare Blog","url":null,"kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Cloudflare Blog","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","locator":"document/html[1]/head[0]/script[56]@12465.publisher"},"assertionId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-24T20:01:05.091Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","contentSha256":"fc7823ab6edd9f1224efe96eb98c06279bc74b6508057271e31f5edf3c09211f","textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observedAt":"2026-10-24T20:01:05.091Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Cloudflare Blog","url":null},"sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","snapshotId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538","contentSha256":"fc7823ab6edd9f1224efe96eb98c06279bc74b6508057271e31f5edf3c09211f","textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observedAt":"2026-10-24T20:01:05.091Z","basis":"publisher-page-metadata","sourceLinks":37,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456/source"}},"canonicalUrl":"https://escapemeridian.com/readings/cloudflare-bringing-post-quantum-cryptography-to-geographically-042f01f9","formats":{"html":"/readings/cloudflare-bringing-post-quantum-cryptography-to-geographically-042f01f9","markdown":"/readings/cloudflare-bringing-post-quantum-cryptography-to-geographically-042f01f9.md","json":"/readings/cloudflare-bringing-post-quantum-cryptography-to-geographically-042f01f9.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"conditions":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-machine-learning","name":"Machine learning","explanation":"Methods that let computers learn patterns from examples instead of following rules written by hand.","referenceUrl":"https://developers.google.com/machine-learning/glossary#machine-learning"}],"entities":[{"id":"cloudflare","name":"Cloudflare","kind":"organization","context":"Cloudflare provides networking, security and computing services that help run websites and applications.","referenceUrls":["https://blog.cloudflare.com/"],"path":"/entities/cloudflare","json":"/entities/cloudflare.json","markdown":"/entities/cloudflare.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456","revision":"591a114d-8c62-4608-8b98-f435634dc04b","revisionKind":"publication-id","title":"Cloudflare: Bringing post-quantum cryptography to geographically fenced key management","url":"https://escapemeridian.com/readings/cloudflare-bringing-post-quantum-cryptography-to-geographically-042f01f9"},"source":{"type":"source","id":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","revision":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","revisionKind":"sha256-source-text","title":"Bringing post-quantum cryptography to geographically fenced key management","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456","title":"Cloudflare: Bringing post-quantum cryptography to geographically fenced key management","argument":"Cloudflare says its post-quantum GeoKey Manager has entered closed beta as part of its Data Localization Suite. The company frames the change around a risk to sensitive data: attackers could store encrypted data now and try to decrypt it later with quantum computers, an attack strategy called “harvest now, decrypt later.”\n\nThe system is designed to restrict where customer private keys can be unwrapped while allowing wrapped keys to be distributed across Cloudflare’s network. Cloudflare describes using regional root keys and application-specific key pairs, with hybrid ML-KEM-768 and X25519 protection. It says edge servers receive regional root keys only when authorized for that region, and requests fail closed if required keys or checks are missing. The design rejects requests rather than unwrapping a key outside its allowed region.\n\nGeoKey Manager addresses one part of data sovereignty: where keys can be used to decrypt data. Cloudflare says it does not control where requests are routed, tunnels terminate, or traffic is inspected. The post also describes an operational tradeoff: keys held in volatile memory must be provisioned again after a server restart.\n\nCloudflare says general availability is planned for Q1 2027, and a separate integration for its existing CDN capability is in development.","topicIds":["power-and-infrastructure","institutions-and-trust"],"domain":"infrastructure","claimType":"attributed reading","limits":"The feature is in closed beta; Cloudflare says general availability is planned for Q1 2027. Cloudflare says the system does not control request routing, tunnel termination, or traffic inspection. The post describes Cloudflare’s design and claims; it does not provide independent testing results or establish operational performance.","speaker":{"name":"Cloudflare","roleAtSource":"Publisher"},"source":{"title":"Bringing post-quantum cryptography to geographically fenced key management","publisher":"Cloudflare Blog","format":"Article","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","publishedAt":"2026-10-23T18:06:56.089Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Cloudflare says the post-quantum GeoKey Manager has launched in closed beta as part of its Data Localization Suite.","excerpt":"Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says the design uses hybrid ML-KEM-768 and X25519 protection, with regional root keys and application-specific key pairs.","excerpt":"Cloudflare therefore uses hybrid ML-KEM-768 and X25519 protection with two kinds of keys","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says edge servers receive only regional root keys authorized for their location, and requests are rejected when required checks fail.","excerpt":"if any required check fails (service context, region, epoch, etc.), the request is rejected.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says GeoKey Manager controls where wrapped private keys can be unwrapped, but not request routing, tunnel termination, or traffic inspection.","excerpt":"GeoKey Manager controls where wrapped private keys can be unwrapped and used on the data plane. It does not control where requests are forwarded or routed","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"Cloudflare says general availability is planned for Q1 2027 and a separate integration with its existing CDN capability is in development.","excerpt":"While general availability (GA) is planned for Q1 2027","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Source-stated"},{"text":"The described design appears intended to limit exposure from stored ciphertext while preserving geographic restrictions on key use; this is an interpretation of Cloudflare’s stated aims.","excerpt":"This protects private-key material against harvest now, decrypt later while preserving regional key-use boundaries.","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","checkedAt":"2026-10-24T20:01:05.091Z","items":[{"type":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","attribution":"Cloudflare Blog","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-10-24T20:01:05.695Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How will Cloudflare validate that regional key access remains restricted as its server locations and regional memberships change?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Cloudflare: Bringing post-quantum cryptography to geographically fenced key management","summary":"Cloudflare says its post-quantum GeoKey Manager has entered closed beta as part of its Data Localization Suite. The company frames the change around a risk to sensitive data: attackers could store encrypted data now and try to decrypt it later with quantum computers, an attack strategy called “harvest now, decrypt later.”\n\nThe system is designed to restrict where customer private keys can be unwrapped while allowing wrapped keys to be distributed across Cloudflare’s network. Cloudflare describes using regional root keys and application-specific key pairs, with hybrid ML-KEM-768 and X25519 protection. It says edge servers receive regional root keys only when authorized for that region, and requests fail closed if required keys or checks are missing. The design rejects requests rather than unwrapping a key outside its allowed region.\n\nGeoKey Manager addresses one part of data sovereignty: where keys can be used to decrypt data. Cloudflare says it does not control where requests are routed, tunnels terminate, or traffic is inspected. The post also describes an operational tradeoff: keys held in volatile memory must be provisioned again after a server restart.\n\nCloudflare says general availability is planned for Q1 2027, and a separate integration for its existing CDN capability is in development.","question":"How will Cloudflare validate that regional key access remains restricted as its server locations and regional memberships change?","claims":[{"text":"Cloudflare says the post-quantum GeoKey Manager has launched in closed beta as part of its Data Localization Suite.","excerpt":"Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta.","support":"source-stated"},{"text":"Cloudflare says the design uses hybrid ML-KEM-768 and X25519 protection, with regional root keys and application-specific key pairs.","excerpt":"Cloudflare therefore uses hybrid ML-KEM-768 and X25519 protection with two kinds of keys","support":"source-stated"},{"text":"Cloudflare says edge servers receive only regional root keys authorized for their location, and requests are rejected when required checks fail.","excerpt":"if any required check fails (service context, region, epoch, etc.), the request is rejected.","support":"source-stated"},{"text":"Cloudflare says GeoKey Manager controls where wrapped private keys can be unwrapped, but not request routing, tunnel termination, or traffic inspection.","excerpt":"GeoKey Manager controls where wrapped private keys can be unwrapped and used on the data plane. It does not control where requests are forwarded or routed","support":"source-stated"},{"text":"Cloudflare says general availability is planned for Q1 2027 and a separate integration with its existing CDN capability is in development.","excerpt":"While general availability (GA) is planned for Q1 2027","support":"source-stated"},{"text":"The described design appears intended to limit exposure from stored ciphertext while preserving geographic restrictions on key use; this is an interpretation of Cloudflare’s stated aims.","excerpt":"This protects private-key material against harvest now, decrypt later while preserving regional key-use boundaries.","support":"interpretation"}],"limitations":["The feature is in closed beta; Cloudflare says general availability is planned for Q1 2027.","Cloudflare says the system does not control request routing, tunnel termination, or traffic inspection.","The post describes Cloudflare’s design and claims; it does not provide independent testing results or establish operational performance."],"mediaId":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","correctionReason":null,"id":"042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456","publicationId":"591a114d-8c62-4608-8b98-f435634dc04b","version":1,"sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","sourceTitle":"Bringing post-quantum cryptography to geographically fenced key management","publisher":"Cloudflare","publishedAt":"2026-10-23T18:06:56.089Z","originalPublished":{"value":"2026-10-23T18:06:56.089Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-23T18:11:14.076Z","createdAt":"2026-11-14T08:48:52.513Z","historical":true,"entityIds":["cloudflare"],"topicIds":["power-and-infrastructure","institutions-and-trust"],"media":[{"id":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","kind":"article","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-24T20:01:05.695Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"4048b5751f67e45e9e8c64ff49cffc753a44828040994135f814187eec913f72","kind":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","label":"View source image","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-24T20:01:05.695Z","method":"publisher_association_and_head","contentType":"image/webp","cacheUntil":1792872065695},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","checkedAt":"2026-10-24T20:01:05.091Z","items":[{"type":"image","url":"https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M5MYF3Y4CXM47ZAN16JYM04W.png&w=1280&h=720&f=webp&fit=cover&position=center","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","attribution":"Cloudflare Blog","basis":"publisher-embed","availability":"verified","verifiedAt":"2026-10-24T20:01:05.695Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"70bdd870b2ac82df6eafbba336af5e0c7c5acd04d9f0476168b76204a3125b8a","confidence":0.91,"provider":"vercel","model":"typesafe-ai/jev","inputHash":"144bca9c48dd64c253f6c68c042c3a3f82ca53377f47c6669280d5da0c215153","decidedAt":"2026-10-24T20:01:07.496Z"},"provenance":{"textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observationId":"009194d8083aa683b4c1b5c6d30f4915e7e64b5089b72ffa2b0e87910e4ff488","retrievedAt":"2026-10-24T20:01:05.091Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"a7e83da1-80ad-409a-8708-0393ff376ab4"},"reviewer":{"model":"gpt-6-luna","runId":"4250ac64-935b-4e30-85be-fff437f21bbc"}},"audit":{"status":"passed","reviewedAt":"2026-11-14T08:48:52.513Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[],"authorRole":"article-author","hosts":[],"status":"missing","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cloudflare Blog","url":null,"kind":"unknown","actorId":null},"role":"publisher","scope":{"kind":"publication","locator":null},"literalCredit":"Cloudflare Blog","status":"stated","provenance":{"basis":"article-publisher","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","locator":"document/html[1]/head[0]/script[56]@12465.publisher"},"assertionId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-24T20:01:05.091Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538","sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","contentSha256":"fc7823ab6edd9f1224efe96eb98c06279bc74b6508057271e31f5edf3c09211f","textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observedAt":"2026-10-24T20:01:05.091Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":{"name":"Cloudflare Blog","url":null},"sourceUrl":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","snapshotId":"43d68101335a9c337592e0cabcdadebcd04dd4083ffec2237b686cd50d2eb538","contentSha256":"fc7823ab6edd9f1224efe96eb98c06279bc74b6508057271e31f5edf3c09211f","textHash":"b247769e8a7893c79e8852a937eed06f6449e8a221c254d2a5265f1d90d8fa7a","observedAt":"2026-10-24T20:01:05.091Z","basis":"publisher-page-metadata","sourceLinks":37,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/042f01f9f27e79083fa58ea4996f18fe3d3d9f0296e172f8a159a905d3024456/source"}}}],"audits":[{"publicationId":"591a114d-8c62-4608-8b98-f435634dc04b","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes the launch, design details, guarantees and timeline to Cloudflare ('Cloudflare says', 'Cloudflare describes'). It keeps the source's claims, such as fail-closed behavior, as Cloudflare's assertions rather than verified facts. The interpretive claim is labeled as interpretation.","excerpt":"Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta."},{"dimension":"summary","status":"pass","explanation":"The summary opens with the actor and the change: a closed-beta post-quantum GeoKey Manager. It explains harvest now, decrypt later in plain language and states the core mechanism: keys are distributed globally but unwrapped only in-region. It explains fail closed, preserves the scope limits on routing, tunnels and inspection, and notes the restart tradeoff. Terms such as ML-KEM-768 and X25519 are kept exactly and suit tooltips. The question is a genuine open issue tied to the source's discussion of changing regional membership. Optionally, one clause could say why regions matter: some regulations require processing within a region.","excerpt":"many data sovereignty regulations require that certain types of data be processed only within a given geographical region"},{"dimension":"date","status":"pass","explanation":"originalPublished (2026-10-23T18:06:56Z, from the publisher page) matches the feed entry time and comes before first observation. No earlier submission is indicated, and the draft adds no conflicting date. Q1 2027 general availability is correctly presented as planned.","excerpt":"While general availability (GA) is planned for Q1 2027"},{"dimension":"support","status":"pass","explanation":"Each claim is source-stated with an accurate excerpt: the closed beta, hybrid ML-KEM-768/X25519, authorized-only key delivery, rejection when checks fail, the scope exclusions, GA timing and CDN integration work. The volatile-memory restart tradeoff is supported. The interpretation claim directly tracks Cloudflare's stated aim. The limitations correctly note there is no independent testing. No benefits, costs or forecasts are invented.","excerpt":"This protects private-key material against harvest now, decrypt later while preserving regional key-use boundaries."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original Cloudflare blog post. That is the most direct way to access the source.","excerpt":null}],"createdAt":"2026-11-14T08:48:52.513Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}