> Does SSH just try the hybrid KEX first and fall back to plain X25519 if the other side doesnt know ML-KEM, or is there some new compatibility dance here? No active probe, its just normal SSH algorithm negotiation, so the peer picks a mutually supported KEX name. If both sides offer the hybrid method, you get ML-KEM plus X25519, otherwise you drop to plain X25519 or whatever else overlaps. The annoying part is the seam, not the math, old servers dont need to know anything about ML-KEM, they just wont have that name in their list.