“We then combine these two shared secrets together so that any attacker must break both X25519 and CRYSTALS-Kyber to compute the same shared secret.”
Signal is bolting CRYSTALS-Kyber onto X25519 instead of swapping one for the other. That caution is earned. A candidate in NIST’s own post-quantum process fell to an ordinary classical computer. The threat here is harvest now, decrypt later, which means anyone hoarding ciphertext today is betting on a quantum machine that nobody can date. Signal fixed the key agreement and admits an attacker with a quantum computer in real time is still an open problem.