It started with a signature.
On June 22, 2026, the President signed two executive orders about quantum computing. One of them directs the federal government to begin retiring the digital signature algorithms that secure nearly everything, on a deadline, with names and dates attached. I find it hard not to notice the shape of that. A signature, ordering the replacement of signatures. The old world authorizing its own succession.
This is the last post in this series, and it is the one where the story stops being history and physics and becomes my day job. Six posts ago we started at Bletchley Park with a machine built to break a cipher everyone believed unbreakable. We followed the thread through Shor’s bridge, through the prism, through the soap bubbles. In the last post I made the case that Q-Day is not a date but a probability distribution, and that for recorded traffic the deadline is earlier than Q-Day anyway. This post is about what the world is actually doing about it, because the answer, as of this summer, is a great deal, in public, on the record, and faster than most people realize.
The replacements already exist
First, the good news, because there is genuine good news. This is not a story about waiting for a solution. The solution shipped two years ago.
Post-quantum cryptography, meaning cryptographic algorithms designed to resist attack by both quantum and classical computers, is not exotic future technology. In August 2024, NIST published the finished standards. The two that matter most for this post carry the names ML-KEM, standardized in FIPS 203, and ML-DSA, standardized in FIPS 204. ML-KEM handles key establishment, which means the process by which two parties who have never met agree on a shared secret key over a public channel. ML-DSA handles digital signatures, which means the process of proving that a message or a piece of software came from who it claims to come from and has not been altered.
Both are built on mathematical problems involving lattices, high-dimensional grids of points, rather than on factoring or its elliptic curve cousin. And the reason for the switch comes straight out of this series. Shor’s algorithm works because factoring hides a rhythm, and a quantum computer can hear rhythms. The lattice problems underneath ML-KEM and ML-DSA have no known rhythm to hear. Nobody has proven none exists, in the same way nobody had proven factoring was safe for the fifty years we bet everything on it. But after years of open, adversarial analysis by the world’s cryptographers, the new problems have no known structure that either a classical or a quantum computer can exploit. The tuning fork gets no answer. That is the strongest guarantee cryptography has ever been able to offer, because it is the same guarantee the old algorithms had, minus the flaw we now know about.
So the algorithms exist, they are standardized, and they are shipping in real products. The remaining problem is the one engineers always inherit from mathematicians. Deployment.
Two signatures in June
Which brings us back to June 22.
The first order, Executive Order 14412, is titled Securing the Nation Against Advanced Cryptographic Attacks, and it converts the migration from advice into instruction. I read the primary text rather than the coverage, and the coverage got details wrong that the text settles, including, in the early days, the order’s own number. Here is what it actually requires. Federal agencies must move their high value assets and high impact systems to post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Every agency had 30 days to name a dedicated PQC migration lead reporting to its CIO. NIST must run a pilot migration of its own systems, complete by the end of 2027. CISA and NIST have 270 days to publish the minimum elements of a cryptographic bill of materials, which is a machine-readable inventory of the cryptographic assets a given piece of hardware or software actually uses. And a proposed federal acquisition rule will extend the compliance requirement to government contractors by the same 2030 deadline. National Security Systems are carved out and handled separately under NSA oversight, with annual reports to the President until their migration is complete.
The order gave OMB 90 days to issue binding guidance to agencies. OMB used two. Memorandum M-26-15 landed on June 24, and it requires every agency to submit a migration plan by October 22, 2026. It also does something the order itself does not, which is publish a phased schedule: inventory and planning through 2027, pilots and early migration through 2028, key establishment migrated by 2030, signatures in 2031, and everything remaining by 2035. The 2030 and 2031 dates are the priority-system deadlines. 2035 is the backstop for the rest. Whatever else you conclude about the machinery of government, the enforcement layer of this particular policy did not stroll.
The second order, Executive Order 14413, Ushering in the Next Frontier of Quantum Innovation, is the other half of the thought. It establishes the Quantum Computer for Application Development and Discovery Science effort, coordinated from the White House science office, to build a quantum computer at a scale intended to begin the era of quantum-enabled scientific discovery, with at least one machine delivered to a Department of Energy facility. The order sets no date for that machine. The Energy Department supplied one the next day, announcing an initiative called Quantum Genesis that targets fault-tolerant systems in 2028 carrying logical qubits in the low hundreds. Read the two orders side by side and the message is hard to miss. The same government is funding the sword and mandating the shield, signed on the same day, with the sword on the nearer date and the shield on the firmer one.
Why keys before signatures
Now look closely at those two dates in EO 14412, because the one-year gap between them is not arbitrary. Key establishment by the end of 2030. Signatures by the end of 2031. Keys first. That ordering encodes the single most important analytical point in this entire post, and it follows directly from the harvest now, decrypt later logic of the last post.
Recorded encrypted traffic is retroactively breakable. An adversary who records your protected traffic today holds ciphertext whose confidentiality depends on a key that was established with quantum-vulnerable mathematics. The day the machine exists, that recording opens. So every day that traffic continues to flow under old key establishment adds to a pile that is already, in a meaningful sense, lost.
Signatures do not work that way. A signature’s job is done at the moment it is verified. An adversary who records a signed software update today and breaks the signature algorithm in 2033 gains almost nothing, because the update was verified and installed years ago, and breaking the old signature does not let anyone reach back in time and forge a different past. To abuse a signature algorithm you must break it while it is still being trusted. That means signature migration is urgent in the ordinary way that patching is urgent, while key establishment migration is urgent in the retroactive way that makes delay permanently unrecoverable. The federal ordering, keys in 2030 and signatures in 2031, gets that asymmetry exactly right.
One honest exception belongs on the record. Signatures with very long verification horizons, code signing and firmware signing above all, sit closer to the key establishment category than the calendar suggests. A signed firmware image may need to be trusted, verified fresh, for fifteen or twenty years on devices that will never see an update pipeline again. Anyone signing things that must still be believed in 2040 should be behaving like a key establishment migrator, not a signature migrator.
And while we are being honest, let me close a door some readers will reach for. Modern TLS uses ephemeral keys, a fresh key agreement for every session, a property called forward secrecy, and it is tempting to hope this defeats the recorded-traffic problem. It does not. Forward secrecy protects you when a long-term key is stolen later. It does nothing against Shor’s algorithm, because the ephemeral public values are right there in the recorded handshake, and reconstructing the matching private values from them is exactly the problem Shor’s algorithm solves. The recording contains everything the mathematics needs. Forward secrecy was built against thieves, not against a machine that unpicks the lock itself.
The uncomfortable ordering inside the old algorithms
Here is the part I have seen almost nowhere in mainstream coverage, and it matters for anyone deciding what to migrate first.
Within the old, vulnerable world, elliptic curve cryptography falls before RSA. That sounds backwards, because ECC was the newer, stronger, more elegant system, the one this series covered in Post 3 as the upgrade. Against classical computers it genuinely is stronger per bit. But Shor’s algorithm mostly cares about key size, and ECC’s efficiency is exactly the property that let everyone use 256-bit keys instead of 2048-bit keys. Smaller problem, smaller quantum computer.
The current numbers make the point concrete. In March 2026, researchers from Google Quantum AI, together with collaborators at the Ethereum Foundation and Stanford, published resource estimates showing that a 256-bit elliptic curve key could be broken with fewer than half a million physical qubits, in a runtime measured in minutes, under the same conservative hardware assumptions that put RSA-2048 at roughly a million qubits and a week. A separate line of academic work published this spring put the logical qubit requirement for a 256-bit curve at 1,193, against 2,043 for the RSA key of equivalent classical strength. That is roughly forty percent fewer. The academic result buys its reduction with a far larger gate count, so the two papers are not measuring the same cost, and I will not pretend they are. But on the resource that decides whether a machine can attempt the attack at all, both now point the same way. The elegant algorithm goes first. Classically stronger turned out to mean quantumly weaker, and there may well be a window in which the machines can break elliptic curves but cannot yet touch RSA. Nearly all modern TLS, and for that matter nearly all cryptocurrency, lives on the wrong side of that window.
The view from the certificate authority
Now let me bring this all the way down to the systems I actually operate, because the vendor side of this migration contains a puzzle that took me some digging to resolve, and the resolution is more instructive than the puzzle.
In May 2026, Microsoft shipped post-quantum support in Active Directory Certificate Services, the certificate authority role that anchors enterprise PKI across an enormous share of the world’s Windows environments. What shipped was ML-DSA. Signatures. The key establishment algorithm, ML-KEM, is slated for a later phase of AD CS, with no date attached. Set that next to the federal deadlines and it looks like an inversion. The policy says keys first, signatures second, correctly, for the harvest-now reasons above. The largest enterprise PKI vendor shipped signatures first and keys later.
The inversion dissolves when you separate two planes that this series has been quietly treating as one. The traffic plane is where harvest now, decrypt later lives, and on that plane Microsoft moved early. ML-KEM has been generally available in the Windows cryptographic platform since late 2025, and on July 14, 2026, hybrid key exchange arrived in the TLS stack itself. Hybrid key exchange pairs a classical algorithm with ML-KEM in the same handshake, so that an attacker must break both. It shipped to Windows 11 and Windows Server 2025 together, and it shipped turned off. The three new groups require TLS 1.3 and an explicit administrator decision to enable them, and the default negotiation order still lists the classical curves. So the recorded-traffic problem is being addressed where recorded traffic actually happens, in the protocol rather than in the certificate. Shipped is not the same as enabled, and enabling it belongs to the people who run the servers.
The certificate plane is a different animal, and it is a signature animal all the way down. A certificate authority’s entire function is signing. Its root certificates are the longest-lived cryptographic objects in most organizations, ten and twenty year lifetimes, which means a root issued today on old algorithms is still being trusted well past every deadline in EO 14412. And here is the operational detail that should focus attention: there is no in-place migration. An existing certificate authority cannot be converted to ML-DSA. The signature algorithm is fixed at creation, so a post-quantum PKI means standing up an entirely new hierarchy in parallel with the old one, migrating trust relationships, templates, and enrollment one dependency at a time. That is not a patch. That is a project measured in years, which is precisely why the CA is where the longest-lead work begins first. Signatures-first at the certificate authority is not the inversion of keys-first policy. It is the same deadline math applied to the slowest-moving objects in the fleet.
One more date belongs in this section. On June 30, 2026, eight days after the executive order, Microsoft moved its own schedule. The roadmap it had published ten months earlier called for early adoption of quantum-safe capabilities by 2029 and full transition by 2033, a position it described at the time as two years ahead of the governments. The new goal is to transition products and services to post-quantum cryptography by 2029 outright, with the work folded into the same engineering framework the company uses for its other security commitments. The stated reason is that the risk horizon has shifted. The announcement cites the executive order in its footnotes. So the apparent inversion resolves a second time, at the level of intent rather than architecture. The largest enterprise PKI vendor is not running against federal policy. It is running a year ahead of it.
I will write more about what a parallel hierarchy build actually involves, because I suspect I am going to be living one. For now the summary for anyone responsible for a PKI is one sentence. The traffic plane migrates by protocol upgrade and the certificate plane migrates by rebuild, and the rebuild is the long pole.
What does not need rescuing
One reassurance before the close, because a series about breaking encryption owes its readers the boundary of the threat.
Symmetric encryption survives, and so does hashing. The AES that encrypts your disk and the SHA-256 that fingerprints your files do not rest on factoring or elliptic curves, and Shor’s algorithm has nothing to say to them. The best known quantum attack against symmetric ciphers offers only a quadratic speedup, which sounds dramatic and is answered, completely, by doubling the key length. AES-256 is expected to remain secure against quantum computers, full stop. The quantum threat is precise, not general. It targets the public-key mathematics that lets strangers establish trust, because that mathematics, and only that mathematics, was built on problems with a rhythm. This is also why a quantum computer will not speed up your spreadsheet, your database, or your compile times. It is not a faster computer. It is a different instrument, and it plays a narrow repertoire devastatingly well.
Closing the loop
Eighty-seven years ago, the British government looked at a machine everyone knew was unbreakable and funded the effort to break it anyway, in secret, under existential pressure, after the catastrophe was already underway. The work at Bletchley Park was heroic partly because it was late. The war did not wait for the bombe, and the bombe had to be built inside the emergency it was meant to end.
What has happened between 1994 and this June is, whatever its imperfections, the opposite shape. The flaw was found by mathematicians decades before the machine that exploits it exists. The replacement mathematics was developed, attacked, and standardized in the open. The deadlines were signed while the largest published demonstration anywhere held 96 logical qubits alive at once, for the length of a single laboratory circuit, and while Google’s own circuits for a 256-bit elliptic curve called for between 1,200 and 1,450 of them, each one holding through tens of millions of operations without a single uncorrected fault. Those are not the same kind of qubit, and the count is the easier of the two gaps to close. For once, the institutions are building the defense before the weapon, in public, with dates attached. You do not defeat an astronomical number by counting through it. You defeat it by exploiting structure. And the last lesson of this series is that the defenders finally learned the same trick as the attackers, which is to exploit the structure of time itself. The migration is racing a machine that does not exist yet, and that is the only race against this machine that can be won.
I am the person who needed to understand what the cryptographer’s work means for the world I live in. Seven posts later, here is what it means. The math is settled, the machines are coming on a schedule nobody knows, the deadlines are real, the replacements work, and the job now belongs to the people who run systems. People like me, and quite possibly people like you.
The bombe is in a museum. The next machine will not take its enemies by surprise.
Mike Howells's Blog 
Leave a comment