Changelog automatic origin key exchange

[ack-cf]

Summary

Screenshots (optional)

Documentation checklist

• Is there a changelog entry (guidelines)? If you don't add one for something awesome and new (however small) — how will our customers find out? Changelogs are automatically posted to RSS feeds, the Discord, and X.
• The change adheres to the documentation style guide.
• If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
• Files which have changed name or location have been allocated redirects.

[cloudflare-docs-bot]

Review

⚠️ 3 warnings found in commit 45fc698.

👉 Fix in your agent 👈

Fix the following review findings in PR #32225 (https://github.com/cloudflare/cloudflare-docs/pull/32225).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.

---

## Code Review

### Warnings (1)

#### CR-1fa822224639 · Technical inaccuracy in cryptographic statement
- **File:** `src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx` line 13
- **Issue:** The sentence states 'Cloudflare uses standardized ML-KEM instead of the obsolete `X25519Kyber768Draft00` key agreement.' ML-KEM is a key encapsulation mechanism (KEM), while `X25519Kyber768Draft00` is a hybrid key agreement that combines X25519 and the draft Kyber KEM. Comparing a KEM directly to a hybrid key agreement misrepresents the cryptographic primitive being replaced.
- **Fix:** Replace the statement with an apples-to-apples comparison, for example: 'Cloudflare uses the standardized `X25519MLKEM768` hybrid key agreement instead of the obsolete `X25519Kyber768Draft00` draft key agreement.'

---

## Conventions

### Warnings (2)

#### CV-6114ee28c505 · No meaningful description
- **File:** PR-level finding
- **Issue:** The description contains only the PR template headings and placeholders with no human-written explanation of the change.
- **Fix:** Add a short summary that explains the changelog entry is being added for automatic origin key exchange under SSL.

#### CV-fd67eb29ad4c · Scope not explained
- **File:** PR-level finding
- **Issue:** The PR adds a new changelog file under src/content/changelog/ssl/, but the description says nothing about the new entry.
- **Fix:** Mention that this PR adds a changelog release note for automatic origin key exchange.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (1)

File

Issue

changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx line 13

Technical inaccuracy in cryptographic statement — The sentence states 'Cloudflare uses standardized ML-KEM instead of the obsolete X25519Kyber768Draft00 key agreement.' ML-KEM is a key encapsulation mechanism (KEM), while X25519Kyber768Draft00 is a hybrid key agreement that combines X25519 and the draft Kyber KEM. Comparing a KEM directly to a hybrid key agreement misrepresents the cryptographic primitive being replaced. Fix: Replace the statement with an apples-to-apples comparison, for example: 'Cloudflare uses the standardized X25519MLKEM768 hybrid key agreement instead of the obsolete X25519Kyber768Draft00 draft key agreement.'

Conventions

Warnings (2)

File	Issue
PR	No meaningful description — The description contains only the PR template headings and placeholders with no human-written explanation of the change. Fix: Add a short summary that explains the changelog entry is being added for automatic origin key exchange under SSL.
PR	Scope not explained — The PR adds a new changelog file under src/content/changelog/ssl/, but the description says nothing about the new entry. Fix: Mention that this PR adds a changelog release note for automatic origin key exchange.

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[yj7o5]

... now automatically selects zone-wide preferred key ...

[lukevalenta]

The 'traffic-weighted origin results' bit is more of an implementation detail and doesn't really make a lot of sense here.. maybe this instead?

Suggested change

	description: Cloudflare now selects one zone-wide key agreement from traffic-weighted origin results, reducing retries and using post-quantum encryption when supported.
	description: Cloudflare now predicts the key agreement algorithm preferred by origins servers to allow for faster connection establishment.

[lukevalenta]

Looks like changelog entries are typically kept pretty brief since they all render on a single page: https://developers.cloudflare.com/changelog/

Perhaps we just state some of the higher-level details and refer to the dev docs? Did something similar here: https://github.com/cloudflare/cloudflare-docs/pull/31540/changes#diff-4f604d1132f43c41a53564b0f8c80495fa529d40a018ff6b9a40b01a69c2e70a