The system question
A cryptographic transition becomes an architecture question when a customer path cannot show where the algorithm choice enters, who owns its replacement boundary, and what test reaches the changed route. A broad transition label can identify work worth inspecting. It cannot answer those local questions for a particular service.
What the public record shows—and does not show
Cloudflare’s published TLS post-quantum experiment records a bounded server-side edge experiment with Google Chrome Canary and Dev clients. Chromium’s CECPQ2 documentation records a compatibility boundary: larger TLS messages can create failures or timeouts when non-compliant middleware cannot handle them, with different remediation contexts beside a site and inside a local network.
That record makes a browser-to-edge-to-middleware boundary visible. It does not establish current Cloudflare, Google, Chrome, or Chromium policy or condition; any user or customer impact; a named operator fault; researcher or company motive, competence, or integrity; a security, readiness, compliance, migration, legal, or deployment conclusion for another system.
The diagnostic: Crypto-swap Scorecard
For one bounded customer path, record four fields:
Direct algorithm naming — where does a component choose a specific algorithm itself?
Seam owner — who owns the boundary that can change that choice?
Replacement test — what test reaches the changed route?
Change surface — which adjacent components would need to change around that decision?
The Crypto-swap Scorecard: direct algorithm naming, seam owner, replacement test, and change surface is an educational discussion aid, not technical, professional, or compliance advice, and it does not determine cryptographic security, migration readiness, or a deployment decision for any system.
How to read the result
If the direct choice reaches an owned seam and an exercised replacement test, the review can narrow to dependencies beyond that boundary. If the trace breaks before the seam, the missing owner or test is the next question—not a readiness verdict.
Parnas’s information-hiding principle gives the architectural reasoning: decisions likely to change should be hidden from modules that do not need to make them. Applying that idea to a cryptographic substitution seam is editorial analysis, not a prescribed interface. NIST’s crypto-agility definition and ECMA’s cryptographic-artifact modeling support the context; neither certifies a customer path.
Source ledger
[S39-01 — NIST, *Considerations for Achieving Crypto Agility*](https://csrc.nist.gov/pubs/cswp/39/upd1/considerations-for-achieving-crypto-agility/final) — crypto-agility definition in a white-paper scope.
[S39-02 — NIST, *Post-Quantum Cryptography Workshops and Timeline*](https://csrc.nist.gov/projects/post-quantum-cryptography/workshops-and-timeline) — dated record states, not an enterprise deadline.
[S39-04 — IACR ePrint 2022/975, *SIKEp434 Is Broken*](https://eprint.iacr.org/2022/975) — bounded SIKEp434 counterweight, not a system finding.
[S39-10 — D. L. Parnas, *On the Criteria To Be Used in Decomposing Systems into Modules*](https://wstomv.win.tue.nl/edu/2ip30/references/criteria_for_modularization.pdf) — information-hiding principle.
[S39-11 — ECMA-424, *The CycloneDX International Standard*](https://ecma-international.org/publications-and-standards/standards/ecma-424/) — structured cryptographic-artifact modeling support.
[S39-12 — Cloudflare, *The TLS Post-Quantum Experiment*](https://blog.cloudflare.com/the-tls-post-quantum-experiment/) — bounded experiment record.
[S39-13 — Chromium, *CECPQ2*](https://www.chromium.org/cecpq2/) — documented middleware compatibility boundary.
Adrian Vance is an AI-generated persona created with AI voice and video technology. Analysis is based on publicly available sources. Educational analysis only—not professional, financial, legal, regulatory, compliance, or technical advice.