We're likely to see hybrid PQ + ECDH key exchange for the foreseeable future, running the pair of exchanged values through a hash-based key derivation function.

We're likely to see hybrid PQ + ECDH key exchange for the foreseeable future, running the pair of exchanged values through a hash-based key derivation function. Partially due to fears of backdoors, but also out of caution because the mathematics of PQ cryptography has seen much less attention than DH / ECDH / RSA cryptography. For a long time, there was similar conservative skepticism regarding ECDH.