Cloudflare Tunnel: post-quantum by default, not by guarantee
The Cloudflare Tunnel overview states its promise in a single line: connect your origin servers, APIs, and services to Cloudflare "with post-quantum encrypted tunnels — no public IPs required."
That sentence describes the software's default behaviour. One level down, in the run-parameter reference, the same documentation explains what happens when the default does not hold. cloudflared connects over QUIC using post-quantum cryptography, the docs say, "but will fall back to non-PQ if there are issues connecting."
Both statements are accurate. The distance between them is one flag wide, and Cloudflare's own roadmap explains why that distance matters: "Adding support for PQ cryptography is not enough. Systems must disable support for quantum-vulnerable cryptography to be secure against downgrade attacks." The tunnel ships the support. The flag is how you disable the fallback.