I built a hybrid PQC platform and I have no idea what to do with it
I'm a software developer from way before AI, from before this flood of badly made SaaS projects and half-baked platforms. I've been building and refining this for more than a year now.
The platform is the following: login is Web3, wallet-based, with EIP-712 typed signatures, no custody of user keys ever. Payment is crypto, and the payment plus the license record settle in one atomic on-chain transaction. Licenses get dual blockchain anchoring: batches go to a public chain as Merkle roots, so any license can prove inclusion without exposing anyone's data, and the full records are mirrored on a private permissioned ledger for enterprise setups.
Under all of it sits the cryptography: AES-256-GCM envelope per content item, the content key encapsulated with hybrid X25519 + ML-KEM-1024, both shared secrets fed into HKDF-SHA384, Ed25519 platform signatures with kid-based key rotation. Delivery is per-buyer proxy re-encryption: the content key gets re-wrapped for each buyer inside an isolated WASM enclave, the content itself is never re-encrypted. Oh, and all of this happens client-side, the server never touches decrypted data. There was a performance problem with that, which I solved by compiling the SDK from the native Rust crypto (standard RustCrypto crates) to WASM.
In the beginning I was thinking DRM. But during the build I accepted that nothing stops someone from recording or sharing content once it's decrypted on a screen. The analog hole doesn't care about ML-KEM. I realized this could still be something, proof of who licensed what and when instead of "nobody can copy this", but honestly I don't know how to move forward. So I ended up building a web3 marketplace hub on top with the dual anchoring above.
One more thing, and it's the uncomfortable part. The marketplace is built, but I never launched it, and the reason is partly ethical. If you've read this far you probably spotted it already: a marketplace where the operator can never inspect content, and where buyers are pseudonymous wallets, is also a perfect channel for material I want no part of. I don't have a real answer for moderation in a system deliberately designed so nobody can look inside, and I'm not willing to operate one without that answer. So take the marketplace off the table, and what's left in my hands is the cryptographic model and the SDK.
And honestly, after a year on this, I think that's the strongest piece anyway: a drop-in Rust/WASM core that encrypts, delivers and licenses content with hybrid post-quantum crypto, and it works independently of everything else.
Anyway, I'd honestly like your opinion. Should I give up and forget this thing, or is there something here worth pursuing, maybe the SDK and the crypto core on their own? And if you spot mistakes in the composition, say it bluntly, that's why I'm posting.