Post-quantum readiness
The only property in SSH where upgrading protects traffic you have already sent.
ssh ssh.rocks pqA web page cannot see your SSH handshake, so the answer for your client comes from the terminal. This page is the reasoning.
This server speaks it
ssh.rocks negotiates mlkem768x25519-sha256 — the
NIST-standardised hybrid — with any client that offers it. A site arguing for
post-quantum key exchange while not speaking it would deserve the
criticism.
Why key exchange is the special case Every SSH session negotiates a shared secret, then encrypts everything with it. If an attacker records the whole session today, decrypting it later means recovering that secret — and the classical hardness of X25519 is exactly the kind of problem a large quantum computer would solve. Your cipher choice does not help here. AES-256 is fine against quantum attack; Grover's algorithm halves its effective key length, which leaves 128 bits, which is plenty. The exposure is entirely in the key exchange. The fix is a hybrid: do X25519 as usual, do a lattice KEM alongside it, and mix both results into the session key. An attacker must break BOTH. That is why the hybrids are rated above plain curve25519 here — they are strictly additive, and the cost is a few kilobytes once per connection. What nobody can tell you is when, or whether, a relevant quantum computer arrives. The case for enabling this is not a prediction. It is that the upgrade is free, already shipped, and is the one change that protects data you have already sent.
Should you actually care?
Honestly: for most shell sessions, no. The question is not "is quantum computing real", it is "is anything I send over SSH still sensitive in fifteen years?" For a hobby server, no. For source code under embargo, credentials with long lifetimes, or anything covered by a retention obligation, quite possibly yes.
The reason to switch it on anyway is that it is free. The hybrids are X25519 plus a lattice KEM, so they are never weaker than what you already have, they are enabled by default in current OpenSSH, and the cost is a few kilobytes once per connection.