Cloudflare and IETF developed an extension for IPsec to prevent downgrade attacks by an attacker on a path between client and server, tricking endpoints into using weaker crypto than they support, exploiting the need for backwards compatibility in the post-quantum migration.