RE:
https://social.secret-wg.org/@huitema/116882677008277980
That is not a backdoor - the change mentioned was made in conjunction with the Kyber developers, was well justified and was made in public. Follow the references in FIPS203 appendix C to see the full discussion and rationale. It is definitely not dynamite.
Seriously, this TLS debate has rotted people's brains to the point where they are willing to swallow obvious disinformation if it reinforces their priors.
I'll again recommend people read
@sophieschmieg@infosec.exchange's excellent post on how ML-KEM literally cannot contain a backdoor:
https://keymaterial.net/2025/11/27/ml-kem-mythbusting/
Lest anyone accuse me of being a NSA shill (this is now an occupational hazard it seems), I prefer hybrid PQ and have personally shipped more of them than almost anyone else than I'm aware of.
The case for hybrids rests on the risks of implementation flaws and speculations that new cryptanalysis might uncover weaknesses. It doesn't need bullshit conspiracy theories.
Open quoted post Quoting
I was expecting popcorn. I was not expecting Jacob Applebaum to post a precise description of how a change made by NIST in the final stages of ML-KEM publication is exactly what you need to establish a secret backdoor. That's not popcorn, that's dynamite. I don't see how the IETF could publish the draft as is after this publication.
https://mailarchive.ietf.org/arch/msg/tls/BfV8R0Dr15PUOGfDi9d7_INJQzo/ 
