The first time I saw a rekey go weird, it was on a bastion I’d just shipped for a lab full of noisy embedded clients, and one box kept chattering through key exchange like nothing had happened. Memory on the server crept up in a way that looked like a leak until I traced it to buffered post-auth messages, which is exactly the sort of thing you only notice when the connection is long-lived and annoying enough to be real. So the stricter KEX behavior here feels less like a hardening footnote and more like a celanup of an assumption that quietly wasn't holding. The seccomp change is the same shape, really, either the sandbox is there and enforced, or you stop pretending it is.

Composite ML-DSA 44 plus Ed25519 sounds like the usual hybrid hedge. Curious if they expect it to stay experimental for a while, or ship as the default path.