Cloudflare cut origin HelloRetryRequests from 52% to 3.7% by asking instead of guessing.

Automatic Key Exchange probes TLS 1.3 origins to learn which key agreement algorithms they actually support, rather than guessing X25519 first (Cloudflare). The static guess was wrong for about 30% of origins and forced a retry handshake costing two round trips. After the change, 99.2% of post-quantum TLS 1.3 connections complete without a retry and p90 handshake latency dropped more than 150ms. Post-quantum origin traffic is at 45 billion daily connections, which is the number that made a wrong guess expensive.