Cloudflare adds ML-DSA authentication for connections to customer origins

Sources: Cloudflare blog
Summary: Cloudflare states that Authenticated Origin Pulls and the Custom Origin Trust Store now accept ML-DSA-44, ML-DSA-65, and ML-DSA-87, which makes fully post-quantum mutual TLS to an origin configurable now rather than after the WebPKI catches up. Keys must be uploaded in the FIPS 204 seed-only encoding, which requires OpenSSL 3.5.0 or later. The global Authenticated Origin Pulls configuration level is not covered yet. Adding post-quantum support without removing trust in the classical mechanisms leaves the downgrade path open.
Why it matters: Origin authentication is the part of a post-quantum migration a customer controls end to end, so it can be moved without waiting on public certificate authorities.