My company builds an encrypted data transfer app that has two layers of encryption. There is an outer layer of TLS encryption using ECDHE with Curve 25519 that runs between app clients and servers. There is also an inner layer of encryption that encrypts data end to end between clients using a 1024-bit Diffie-Hellman key agreement (yes we need to replace that)
Our customers are asking for post quantum protection now because of the long term value of the data they want to protect. Instead of replacing one layer of encryption with a classical/post quantum hybrid scheme (which seems to be popular) we would like to leave the key management for our outer layer TLS protection with Curve 25519 intact and replace the only inner layer key management (the 1024-bit Diffie-Hellman) with a post quantum hybrid scheme like Kyber, New Hope, or SIDH.
Would it be accurate to tell our customers that a layer of classical public key based encryption covering a layer of post quantum public key based encryption is an roughly equivalent to replacing one layer of the encryption with a classical/post quantum hybrid? We need to replace our inner layer key management anyway and putting in a post quantum solution there would be convenient.