A server that can do post-quantum key exchange but still accepts a classical-only peer is not protected. Data is only as safe as the weakest hop it crosses. A key is only as safe as its weakest copy. sebbi.pro tests all three for real, and seals the evidence.
For each hop sebbi.pro sends real TLS handshakes: post-quantum groups only (is one selected?), classical groups only (is it refused?), TLS 1.2 only (is it refused?), and both together (does it insist on post-quantum?). Only refusal is enforcement.
A key from a key derivation function breaks only if every input breaks. Any key breaks as soon as any readable copy of it is wrapped under a breakable key. List your keys and where their copies live:
One-off inventories go stale. With a sebbi.pro API key a path is re-tested daily, and each result is sealed, so you build a timeline of evidence a regulator, auditor or insurer can check: POST https://sebbi.pro/x/qpath/watch {name, hosts, shelf_years, migrate_years, crqc_years}. 50p per endpoint per month after 7 days free. Get a key.
How it works · NIST proposes deprecating classical public-key algorithms after 2030 and disallowing them after 2035.