Post-quantum encryption leaves another job: proving who is connected

A connection needs to establish secret keys and authenticate the party at the other end. Moving key exchange to a post-quantum algorithm does not automatically replace the signature machinery used for authentication. Cloudflare’s July discussion of ML-DSA makes this distinction explicit: progress on encryption can coexist with substantial remaining work on signatures. A readiness percentage needs to say which of those jobs it measures.

Post-quantum signatures can be considerably larger than familiar elliptic-curve signatures. That affects more than the code that verifies them. Certificates pass through applications, trust stores, inspection equipment and management services; some keys live in hardware security modules. Storage limits, message-size assumptions and renewal processes can become compatibility problems. Cloudflare argues for using available standardised algorithms while research on alternatives continues, rather than treating an improved future design as a substitute for migration work.

Microsoft’s 8 October overview describes its PQC TLS Pilot Program, launched on 27 August for eligible certificate authorities. The controlled programme uses ML-DSA-87 to test certificate hierarchies and interoperability. Microsoft explicitly says pilot certificates are not publicly trusted and must not be used for public production trust. A successful experiment demonstrates something about that test environment, not universal acceptance across clients.

The immediate engineering task is to understand dependencies before replacing a certificate hierarchy. An application accepting a new certificate is one result; a renewal job, load balancer or inspection device processing the same chain is another. A representative non-production environment can reveal where those assumptions diverge. An inventory should distinguish systems that issue, validate, store and distribute certificates, then connect each role to a vendor roadmap and test result. That gives a team evidence about its migration path instead of one broad label suggesting every layer has already changed.