Add --ssl-groups option for Post-Quantum TLS key exchange (X25519MLKEM768)

[netanmangal]

France's ANSSI will stop certifying security products without post-quantum cryptography starting in 2027. The US White House issued Executive Order 14409 mandating PQC for all federal systems - key establishment by 2030 and digital signatures by 2031, affecting every federal contractor and vendor.

Problem

Uvicorn is the default ASGI server for FastAPI (~99K stars). It handles TLS termination but provides no way to configure TLS key exchange groups. The hybrid post-quantum group X25519MLKEM768 cannot be configured through uvicorn's SSL options.

Python's ssl.SSLContext.set_ecdh_curve() cannot set PQC groups due to OpenSSL NID validation limitations.

Proposal

Add --ssl-groups CLI option that configures TLS key exchange groups via OpenSSL's SSL_CTX_set1_groups_list().

Example:

uvicorn --ssl-groups "X25519MLKEM768:X25519:prime256v1" app:app

References

• NIST FIPS 203 (ML-KEM)
• US Executive Order 14409

[netanmangal]

I'm happy to take up this issue and raise a PR.