Cloudflare's closed beta of a post-quantum GeoKey Manager uses HPKE with a hybrid ML-KEM-768 and X25519 KEM to protect region-bound decryption keys. It replaces attribute-based encryption for existing Data Localization Suite customers, with general availability planned for early 2027.