> I agree that for the time being, the average X25519 impl will be significantly more trustworthy than the average Kyber implementation (or any other PQ constru

> I agree that for the time being, the average X25519 impl will be significantly more trustworthy than the average Kyber implementation (or any other PQ construction), due to its maturity, but it seems dishonest to imply that PQ algorithms are inherently harder to get right. I understood TFA's point to be exactly this. That is, security designs that have existed significantly longer and were in active, widespread use will have been analysed far better than the new kids on the block.