Are PQ/Classical Hybrid Key Exchanges a reflection of how little we trust PQ cryptography primitives? My students have asked me some questions about why there are standards being developed for hybrid public key systems with both a classical and a post-quantum component.  

Given that when elliptic curve cryptography was first being deployed no one suggested using elliptic curve cryptography with classical RSA or Diffie-Hellman in a hybrid scheme; when SHA-3 was standardized no one suggested making a hybrid of SHA-3 and SHA-2; and when AES was invented no one suggested using it in a hybrid with Triple DES or some other cipher--is the desire for PQ hybrids a reflection of the distrust we have in the fundamental primitives that underly our post-quantum schemes?   

If we do trust these primitives, why the need for a hybrid?
Actually, we do trust many (but obviously not all) post-quantum cryptosystems more than traditional schemes. We haven't been using them because they fail to meet practical space and time trade-offs.


  When elliptic curve cryptography was first being deployed no one was suggesting using elliptic curve cryptography with classical RSA or Diffie-Hellman in a hybrid scheme.


A hybrid solution would defeat the primary motivation of switching to ECC; faster, smaller and more secure. PQ schemes may be faster xor smaller, but our interest is in their increased security.


  When SHA-3 was standardized no one suggested making a hybrid of SHA-3 and SHA-2. When AES was invented no one suggested using it in a hybrid with Triple DES or some other cipher.


Many applications use multiple hash functions either for cross version compatibility or increased collision resistance. I.e. MD5, SHA1, and SHA256 checksums for source or package distribution.


  Is the desire for PQ hybrids a reflection of the distrust we have in the fundamental primitives that underlay our post quantum schemes?


The primary applications for PQ where hybrids are desired involve forward secrecy in key exchanges. If we must spend the time and bandwidth for a PQ scheme, then using ECC in addition to this is almost negligible.


  If we do trust these primitives why the need for a hybrid?


If I audit a piece of software and I know it uses a hybrid scheme and I understand and trust one of its components, such as ECC, then I may be satisfied without having to learn about the particular PQ scheme in use. If an assumption in the PQ scheme is incorrect, I know the protocol is at least as secure as the traditional scheme.