Cloudflare opens closed beta for post-quantum regional key management

Cloudflare has launched a closed beta of PQ GeoKey Manager, which it says restricts access to customers' decryption keys to their chosen geography while adding protection against future quantum attacks. General availability is planned for Q1 2027. The system combines ML-KEM-768 and X25519 cryptography to protect private keys distributed across Cloudflare's network. Only authorized servers within the selected region receive the regional secret needed to unlock them. Requests fail if the required regional key is unavailable. The product controls where keys can be unlocked and used. Separate systems govern request routing, tunnel termination and traffic inspection, so key restrictions alone do not determine every aspect of data location.