The bottleneck: Post-quantum signature algorithms like ML-DSA and SLH-DSA produce signatures far larger than RSA or ECDSA. Bolt them onto TLS naively and handshakes bloat, latency climbs, and connections fail at scale.
The fix — Merkle Tree Certificates (MTCs): Instead of transmitting a full post-quantum signature on every handshake, an MTC proves your certificate is logged in a trusted, publicly auditable registry using a lightweight proof. You get quantum resistance without the handshake tax.
The rollout: Cloudflare acquired Root CA key material from GlobalSign and applied to the Chrome, Apple, Microsoft, and Mozilla root programs. Classical certificates come first; production MTC issuance targets Q1 2027, paired with RFC 9773 automated renewal so entire certificate fleets can rotate instantly — no manual cert-herding required.
The catch: Internet-scale PKI is now moving ahead of most enterprise migration plans. If you don’t know which CAs issue your certificates, how renewal is automated, or whether your stack can even parse a non-RSA/ECDSA chain, a browser root program mandate will find out for you.
Bottom line: PQC migration isn’t only about which algorithms you choose — it’s also about the public infrastructure you depend on changing underneath you, on someone else’s timeline. Map your certificate dependencies now, before they become someone else’s deadline.
At Qubit Guard, this is exactly the blind spot our QuantVision discovery engine is built to close — surfacing every CA, cert chain, and renewal path hiding across your stack before the root programs force the issue.
How is your team tracking certificate authority and PKI dependencies as part of your PQC migration plan?
#PostQuantumCryptography #PQC #Cybersecurity #CryptoAgility #CISO #QuantumSafe #TLS #PKI #InfoSec #TechLeadership
Sources:
https://www.google.com/url?q=
https://www.google.com/url?q=