Caddy 2.11 enables post-quantum TLS by default, expanding handshake size sixfold

Caddy 2.11 now defaults to a hybrid post-quantum key exchange called X25519MLKEM768, combining the classical X25519 algorithm with NIST-standardised ML-KEM-768 to protect against future quantum computing threats. The change is motivated by 'harvest now, decrypt later' attacks, where adversaries record encrypted traffic today intending to decrypt it once quantum hardware becomes available. Testing with OpenSSL 3.5.7 confirmed the new default is negotiated automatically without any configuration changes, but the larger ML-KEM key sizes cause the combined TLS handshake to grow from 440 bytes to 2,704 bytes — a 6.1x increase. While this overhead is negligible on standard broadband connections, it could introduce noticeable latency on satellite links, congested mobile networks, or other bandwidth-constrained environments. Caddy's access logs do not expose which key exchange was used, so administrators must capture traffic directly to verify whether the post-quantum default is active in production.