Android outlines post-quantum signatures from boot to app updates

Google announced on 25 March that it would begin testing post-quantum changes in the next Android 17 beta. The programme covers Verified Boot, remote attestation and app authenticity. It introduces the ML-DSA signature algorithm into parts of the platform’s chain of trust rather than treating quantum resistance as a single application feature.

The announcement described ML-DSA support in Android Keystore and hybrid app signatures combining conventional and post-quantum keys. Play App Signing would manage supported key upgrades for participating developers. The March account set out a staged beta-to-production transition. It did not mean every installed Android phone had already gained these protections, or that upgrading app signatures alone migrated all encrypted traffic.