Hybrid key exchange performs two key exchanges in one handshake — one classical, one post-quantum — and derives the session key from both.
An attacker must break both to recover the session. Breaking either alone achieves nothing.
Why not post-quantum alone
Two risks are hedged simultaneously.
Classical algorithms like X25519 are extremely well studied but fall to Shor's algorithm on a capable quantum computer.
Post-quantum algorithms like ML-KEM are believed secure against quantum attack but are young. Lattice cryptography has received serious scrutiny, though not the decades elliptic curves have had. If a classical break of ML-KEM were found, anyone who had already removed X25519 would be worse off than when they started.
Hybrid means neither failure is fatal.
Not a temporary measure
It is tempting to read hybrid as a stepping stone to discard once post-quantum algorithms are trusted. The standards do not treat it that way: NIST's draft transition guidance explicitly does not catch hybrid modes in its 2035 disallowance of quantum-vulnerable algorithms.
Hybrid is a defensible long-term position, and it is what X25519MLKEM768 provides on the web today.
Requires TLS 1.3
Hybrid groups exist only in TLS 1.3. A server limited to TLS 1.2 cannot negotiate post-quantum key exchange at all, whatever its library supports — which is why "no TLS 1.3" acts as a hard ceiling on any post-quantum readiness grade.