DO NOT MERGE - [workers] support for modern crypto algorithms

src/content/changelog/workers/2026-07-23-webcrypto-modern-algorithms.mdx

@@ -0,0 +1,57 @@
+---
+title: Web Crypto adds ML-KEM and ML-DSA support
+description: The Workers runtime adds opt-in post-quantum algorithms and key encapsulation methods through a compatibility flag.
+products:
+  - workers
+date: 2026-07-23
+---
+
+import { TypeScriptExample, WranglerConfig } from "~/components";
+
+The Workers Web Crypto API now supports ML-KEM-768, ML-KEM-1024, and all three ML-DSA parameter sets. ML-KEM establishes shared secrets, while ML-DSA signs and verifies data.
+
+The opt-in API also adds key encapsulation and decapsulation methods, `getPublicKey()`, `SubtleCrypto.supports()`, and JSON Web Keys (JWKs) with the `AKP` key type.
+
+Turn on the `webcrypto_modern_algorithms` compatibility flag to use these features:
+
+<WranglerConfig>
+
+```toml
+compatibility_date = "$today"
+compatibility_flags = ["webcrypto_modern_algorithms"]
+```
+
+</WranglerConfig>
+
+This example uses ML-KEM-768 to establish the same shared secret on both sides:
+
+<TypeScriptExample filename="src/index.ts">
+
+```ts
+const keyPair = await crypto.subtle.generateKey(
+	"ML-KEM-768",
+	false,
+	["encapsulateBits", "decapsulateBits"],
+);
+
+if (!("publicKey" in keyPair)) {
+	throw new Error("Expected an ML-KEM key pair");
+}
+
+const { sharedKey, ciphertext } = await crypto.subtle.encapsulateBits(
+	"ML-KEM-768",
+	keyPair.publicKey,
+);
+
+const recoveredSharedKey = await crypto.subtle.decapsulateBits(
+	"ML-KEM-768",
+	keyPair.privateKey,
+	ciphertext,
+);
+```
+
+</TypeScriptExample>
+
+Workers implements a subset of the evolving [Modern Algorithms in the Web Cryptography API](https://wicg.github.io/webcrypto-modern-algos/) draft. ML-KEM-512 and the draft's other algorithms are not supported. The API may change as the draft evolves.
+
+For current algorithm and operation support, refer to [Web Crypto supported algorithms](/workers/runtime-apis/web-crypto/#supported-algorithms).

src/content/compatibility-flags/webcrypto-modern-algorithms.md

@@ -0,0 +1,20 @@
+---
+_build:
+  publishResources: false
+  render: never
+  list: never
+
+name: "Web Crypto modern algorithms"
+sort_date: "2026-07-23"
+experimental: true
+enable_flag: "webcrypto_modern_algorithms"
+---
+
+Enables the Workers subset of the evolving [Modern Algorithms in the Web Cryptography API](https://wicg.github.io/webcrypto-modern-algos/) draft. This subset includes:
+
+* ML-KEM and ML-DSA.
+* Key encapsulation and decapsulation methods.
+* `getPublicKey()` and `SubtleCrypto.supports()`.
+* JSON Web Keys (JWKs) with the `AKP` key type.
+
+Workers does not implement the full proposal. The API may change as the draft evolves. Refer to [Supported algorithms](/workers/runtime-apis/web-crypto/#supported-algorithms) for current support.

src/content/docs/workers/runtime-apis/web-crypto.mdx

@@ -550,6 +550,20 @@ If a feature only implements the operation partially, details are listed.
 
 3. <a name="footnote-3"></a> MD5 is not part of the WebCrypto standard but is supported in Cloudflare Workers for interacting with legacy systems that require MD5. MD5 is considered a weak algorithm. Do not rely upon MD5 for security.
 
+#### Modern algorithms
+
+The [`webcrypto_modern_algorithms` experimental compatibility flag](/workers/configuration/compatibility-flags/#web-crypto-modern-algorithms) enables a subset of the evolving [Modern Algorithms in the Web Cryptography API](https://wicg.github.io/webcrypto-modern-algos/) draft.
+
+| Algorithm                                     | sign()<br/>verify() | encapsulateKey()<br/>encapsulateBits()<br/>decapsulateKey()<br/>decapsulateBits() | generateKey() | exportKey() | importKey() |
+| :-------------------------------------------- | :------------------ | :-------------------------------------------------------------------------------- | :------------ | :---------- | :---------- |
+| ML-DSA-44, ML-DSA-65, and ML-DSA-87          | ✓                   |                                                                                   | ✓             | ✓           | ✓           |
+| ML-KEM-768 and ML-KEM-1024                    |                     | ✓                                                                                 | ✓             | ✓           | ✓           |
+| ML-KEM-512                                    |                     | ✘                                                                                 | ✘             | ✘           | ✘           |
+
+The flag also adds `getPublicKey()` and `SubtleCrypto.supports()`. It supports JSON Web Keys (JWKs) with the `AKP` key type.
+
+Workers does not implement other algorithms from the draft. This API may change as the draft evolves.
+
 ***
 
 ## Related resources