KXCO has made ML-KEM-1024 the default for new keys and encryption across its post-quantum packages and pqc.kxco.ai vault, with ML-DSA-87 as the signing key default.

The statement notes that the system now prioritizes stronger, standards-aligned cryptography with decisions to keep legacy paths for compatibility and governance considerations.

NSA CNSA 2.0 timelines set January 1, 2027, as the start for CNSA 2.0 compliant NSS acquisitions, with broader migration goals through 2030 and 2035 for quantum resistance.

Installation and usage guidance emphasizes Node.js 22.12+, ESM module, npm install kxco-post-quantum, and a signed jws that verify with kxco-verify, plus a pointer to What TLS Leaves Out.

kxco-post-quantum's release and policy cover ACVP test vectors, three-party cooperative operations, BOM/SBOM, SLSA provenance, CycloneDX CBOM, and supply-chain safety tooling.

The U.S. government’s Executive Order 14412 is cited to shift high-value assets to PQC by 2031-2030, with M-26-15 BOM requirements and PQC signing in API networks; the UK and other regions are aligned on timeframes.

Existing ML-KEM-768 data remains decryptable, with compatibility preserved and explicit downgrade paths for legacy usage.

TLS and data transfer layers have undergone hybridization, with current signing, certificates, and DIAG requirements, while legacy compatibility and downgrade paths remain in place.

KXCO posts free under Apache-2.0; institutions can inquire about CNSA 2.0 migration.

Buyers can validate defaults and compatibility by checking npm package provenance, ML-KEM-1024 seals in uploads, KXCO’s published key lists, and cryptographic BOMs.

The project tracks a split deployment: a paid line with optional secure onboarding, including key escrow, signature, and relaying, with notes on pricing and packaging.

Files uploaded to pqc.kxco.ai since mid-October 2026 are sealed with ML-KEM-1024, while older uploads remain decryptable with prior keys.