Post-Quantum Migration

Established Every public-key system protecting today’s internet—RSA, finite-field Diffie–Hellman, and elliptic curves—falls to a sufficiently large quantum computer running Shor’s 1994 algorithm. Symmetric ciphers and hash functions are only quadratically weakened by Grover’s algorithm, so AES-256 and SHA-384 survive with comfortable margin. The exposure is specific: the public-key layer that negotiates session keys and signs identities, which is also the layer hardest to replace because it is woven into every protocol, certificate, smart card, and boot ROM on Earth.

Established The migration to quantum-resistant replacements is no longer prospective; it is a measured, lopsided fact. NIST published the first three post-quantum standards in August 2024 (FIPS 203, 204, and 205). By February 2026 more than 60% of human-initiated browser traffic reaching Cloudflare’s network negotiated hybrid post-quantum keys, up from under 3% at the start of 2024—while essentially no public web server yet presents a post-quantum certificate. Half the problem is moving at internet speed; the other half has barely started.

Frontier The schedule is set by harvest-now-decrypt-later, not by the arrival date of a quantum computer. Encrypted traffic recorded today can be decrypted whenever a capable machine exists, so any data whose confidentiality must outlast the migration is already in play. Mosca’s inequality states the logic: if data shelf-life plus migration time exceeds the time to a cryptanalytically relevant quantum computer (CRQC), the exposure has already begun. How much systematic harvesting actually occurs is genuinely contested; the incentive and the interception capability are documented, the archives are not.

Speculative When a CRQC will exist is the one honestly speculative element in the field. Expert surveys return probability distributions, not dates, and the distributions are wide. This brief therefore treats the attack date as speculation to be bracketed, and the migration itself—standards, telemetry, deadlines, hardware replacement cycles, institutional throughput—as the measurable frontier it actually is.

Established The standards exist because of an eight-year open competition that was adversarial by design. NIST issued its call for proposals in December 2016 and accepted 69 complete submissions into round one in 2017, spanning five mathematical families: lattices, error-correcting codes, hash functions, multivariate polynomials, and supersingular isogenies. Candidates were winnowed through public cryptanalysis rather than committee preference—nine advanced by January 2019, seven finalists plus eight alternates by July 2020.

Established Two late-stage candidates were destroyed by classical attacks, before deployment—which is the process working, and the field’s central cautionary datum. In February 2022 Ward Beullens broke the multivariate signature finalist Rainbow in, by his own description, a weekend on a laptop. In July–August 2022 Wouter Castryck and Thomas Decru broke the isogeny-based SIKE—a fourth-round candidate that had survived five years of scrutiny—with a classical attack recovering keys in roughly an hour on a single core. Neither break used a quantum computer. Both used mathematics nobody had aimed at those schemes before.

Established The Secretary of Commerce approved the first three Federal Information Processing Standards on 13 August 2024. FIPS 203 specifies ML-KEM (from CRYSTALS-Kyber) for key establishment; FIPS 204 specifies ML-DSA (from CRYSTALS-Dilithium) as the primary signature; FIPS 205 specifies SLH-DSA (from SPHINCS+), a conservative hash-based signature kept precisely because its security rests on different mathematics. On 11 March 2025 NIST selected the code-based HQC as a backup KEM (documented in NIST IR 8545), again explicitly for mathematical diversity against a possible lattice surprise; its draft standard is expected around 2026 and finalisation around 2027.

Frontier The standards pipeline is not finished. FIPS 206 (FN-DSA, from FALCON) remained in draft through mid-2026 because FALCON’s signing depends on floating-point Gaussian sampling that is notoriously hard to implement in constant time without leaking the key. A parallel “on-ramp” round for additional signatures drew 50 submissions, of which 40 entered round one and 14 advanced in October 2024. The portfolio, in other words, is still being hedged while the first tranche deploys.

Established Key agreement on the public web has migrated faster than any cryptographic transition ever measured. In February 2024 roughly 2% of TLS 1.3 connections to Cloudflare used post-quantum key agreement, over 99% of it from Chrome, which had then enabled the hybrid X25519+Kyber-768 exchange for about a tenth of users. Chrome turned the hybrid on by default in version 124 (spring 2024) and moved to the final ML-KEM encoding later that year; Firefox, OpenSSL, Go, and Apple’s operating systems followed with defaults of their own. By October 2025 more than half of human-initiated traffic to Cloudflare used ML-KEM-based hybrids; by February 2026 the figure exceeded 60%. These are one vendor’s viewpoint figures, but the vendor sits in front of roughly a fifth of the web, and no published measurement contradicts the trend.

Established The measured costs of that first migration were real but absorbable. An ML-KEM-768 exchange adds roughly a kilobyte per peer against 32 bytes for X25519—about a 30× increase—which splits the TLS ClientHello across two packets and produced a measured 4% median latency increase on desktop handshakes. The rollout surfaced latent bugs in TLS-inspecting middleboxes, forced an enterprise opt-out policy, and delayed Android. Cloudflare’s testing against customer origin servers found a 0.34% failure rate for the fast deployment path, almost all from servers mishandling oversized hellos. Ossification, not mathematics, was the operational enemy.

Established Server-side and messaging migrations show the same shape: fast where one actor controls both ends, slow where nobody does. Origin servers able to negotiate post-quantum key agreement went from under 1% at the start of 2025 to about 10% in early 2026—a tenfold jump driven by TLS libraries enabling it by default, yet still a 50-point gap behind browsers. Signal shipped PQXDH in September 2023, wrapping CRYSTALS-Kyber around X25519 so an attacker must break both, explicitly citing harvest-now-decrypt-later; in October 2025 it announced the Triple Ratchet, adding a sparse post-quantum ratchet (SPQR) that erasure-codes ML-KEM material across messages to deliver post-quantum forward secrecy. Apple deployed PQ3, a hybrid ratcheted design for iMessage, in early 2024. Cloudflare extended hybrid ML-KEM to IPsec and its SASE platform in February 2026.

Established The second migration—signatures and certificates—has barely begun, for measurable reasons. At the AES-128 security level, Ed25519 costs 32 bytes of public key and 64 of signature; ML-DSA-44 costs 1,312 and 2,420; SLH-DSA-128s costs 32 and 7,856; FN-DSA-512 is the compact option at 897 and 666 but is the one that is dangerous to implement. A TLS handshake carries several certificates and signatures, so these numbers multiply. As of early 2026 no post-quantum certificate is trusted by mainstream browsers: hybrid certificate standardisation was still pending, and certification authorities are gated on FIPS-validated HSM firmware and audit cycles. First pilot issuance is expected in 2026, broad browser trust not before 2027.

Established Governments have converted the uncertainty into deadlines clustered in 2030–2035. The NSA’s CNSA 2.0 suite (September 2022) requires quantum-resistant firmware signing first—via the stateful hash schemes of NIST SP 800-208—with phased milestones through the decade and exclusive use on national security systems by 2033. NIST’s draft IR 8547 (November 2024) deprecates RSA and elliptic-curve cryptography after 2030 and disallows them for US federal use after 2035. The UK NCSC’s March 2025 timeline requires discovery and planning by 2028, high-priority migration by 2031, and completion by 2035. Australia’s ASD set 2030. The EU roadmap points at 2030 for high-risk systems. The US Quantum Computing Cybersecurity Preparedness Act (December 2022) mandated federal inventories, and the White House’s 2024 report to Congress priced federal civilian migration at roughly US$7.1 billion for 2025–2035 (the programme’s own figures).

Frontier Against all this, the actual quantum-computing record remains modest and the projections volatile. No quantum computer has factored any cryptographically meaningful number; honest Shor-style demonstrations remain at the scale of 15 and 21. But resource estimates keep falling: Craig Gidney’s May 2025 analysis put RSA-2048 within reach of under one million noisy qubits running for under a week—twenty times fewer than his own 2019 co-estimate. The Global Risk Institute’s 2025 expert survey (26 respondents) produced its most aggressive timeline in seven years: aggregated estimates of a CRQC within ten years spanned roughly 28–49% depending on weighting, 13 of 26 experts put the 10-year probability near or above 50%, and about 69% put the 15-year probability at 50% or higher. Those are opinions, not measurements—and the survey has known weaknesses—but the direction of revision has been consistently earlier.

Frontier The monoculture question: how much of the world should rest on one family of assumptions? ML-KEM and ML-DSA both reduce to structured (module) lattice problems. The portfolio was deliberately hedged—SLH-DSA on hash functions, HQC on codes—but deployment gravitates to the fast option, and today essentially all post-quantum traffic is lattice-based. Whether diversity that exists on paper but not in deployed code is worth anything in a crisis is an open and largely unmodelled question.

Frontier Hybrid versus pure deployment is a live disagreement among serious agencies, and the ties should be declared. The NSA’s CNSA 2.0 specifies standalone ML-KEM and ML-DSA and treats hybrid constructions as unnecessary complexity; Germany’s BSI and France’s ANSSI recommend or require classical-plus-post-quantum hybrids well into the 2030s; the actual public internet shipped hybrids essentially everywhere. Practice has sided with the Europeans for now, mostly because the SIKE break made pure-scheme confidence feel expensive.

Frontier Whether the Web PKI is migrated in place or re-architected is unresolved. Multiplying kilobyte-scale signatures through certificate chains is painful enough that proposals circulate to change the trust architecture itself—trust-anchor negotiation, Merkle-tree certificates that amortise signatures—rather than merely swap algorithms. Google has argued publicly for trust-anchor agility before standardising post-quantum authentication for the public web.

Frontier The evidentiary quality of harvest-now-decrypt-later is weaker than its rhetorical ubiquity. Bulk interception of transit traffic by major intelligence agencies is documented historical fact, storage costs permit indefinite retention, and the incentive is obvious. What does not exist in public is direct evidence of any specific adversary curating an archive for future quantum decryption: the claim is asserted by officials whose supporting material is classified. Speculative The strong version—named states, systematic programmes, specific targets—remains inference from capability plus motive, and honest treatments say so.

Speculative The CRQC timeline itself is the field’s licensed speculation, best handled as a distribution. Survey medians have moved earlier three years running; error-corrected logical-qubit demonstrations improved markedly in 2024–2025; and algorithmic overhead keeps shrinking (Gidney’s 20× reduction). None of this yields a date, and the survey instrument itself is fragile—26 self-selected respondents, none based in China, whose quantum programme the same literature calls a leader.

Handwave “AI will accelerate cryptanalysis and collapse the timeline” is, so far, assertion. No machine-learning system has produced an attack of consequence against any standardised scheme, classical or post-quantum. The claim is worth tracking precisely because the SIKE break shows single papers can be discontinuous—but as of 2026 it has no evidentiary base.

Established Cryptographic inventory is the binding constraint: organisations cannot migrate what they cannot find. Keys and algorithms hide in firmware, vendor binaries, third-party libraries, embedded protocols, backup archives, and contracts. US federal agencies, under a statutory mandate and OMB guidance, took years to produce inventories that remain self-reported and partial. Frontier Discovery tooling—network scanners, code analysis, the cryptographic bill of materials (CBOM) formats added to standards like CycloneDX in 2024—exists but is immature, and no published measurement shows any large enterprise with a verifiably complete inventory.

Established Signature size is a physical bottleneck, not a preference. A 2,420-byte ML-DSA signature where 64 bytes used to sit breaks size budgets across DNSSEC over UDP, constrained radio links, smart-card EEPROM, and boot ROMs. This—not conservatism—is why the signature migration trails key agreement by years.

Frontier Validation throughput gates the regulated world. Government and much critical-infrastructure procurement requires FIPS 140 validation; NIST’s CAVP began testing the new algorithms, but certification queues run months to years, and every HSM, TLS stack, and smart card must pass through them before regulated buyers may deploy.

Established Hardware roots of trust are the slowest-moving layer, and the planners know it. Certificate-authority keys live in HSMs that need validated post-quantum firmware; secure-boot verification keys are masked into silicon with 10–20-year product cycles. CNSA 2.0 sequenced firmware and software signing first—using the stateful hash-based signatures of SP 800-208, which were standardised early for exactly this—because a device whose boot ROM trusts only ECDSA can never be securely upgraded later. Fleets that cannot be re-keyed will simply age out insecure.

Established The long-lived tail dwarfs the web. Cars run 15–20 years, industrial control and grid equipment 20–40, satellites are unpatchable in any deep sense once flown, and medical implants sit inside people. Much of this population cannot meet any 2035 deadline; the honest framing is triage, not completion.

Frontier Money and attention are finite, and the measured costs are large. US$7.1 billion is the federal civilian estimate alone; no credible global figure exists. Cryptography teams are small, the work is invisible when it succeeds, and every CISO must weigh a probabilistic 2030s threat against this quarter’s breaches. The migration’s real rate limiter may be organisational patience.

Established The entire edifice depends on sustained public cryptanalysis. Confidence in ML-KEM is not a proof; it is the accumulated failure of the world’s cryptanalysts to break structured lattices, renewed annually. The Rainbow and SIKE breaks show what that renewal is worth—and what its absence would hide.

Frontier Quantum resource estimation is the discipline that converts hardware news into risk. The 2019-to-2025 fall from 20 million to under one million qubits for RSA-2048 changed planning more than any device announcement. Whether that curve continues, flattens, or was an artefact of low-hanging optimisation is a research question with direct policy consequences.

Frontier Implementation science must keep pace with mathematics. Timing leaks were found in widely used Kyber implementations in 2023–2024; FN-DSA’s floating-point sampling has delayed an entire FIPS. Formal verification and constant-time engineering of the new primitives are active dependencies, not solved problems.

Established Protocol standardisation is the transmission belt. ML-KEM reached the web through IETF integration into TLS 1.3, and is reaching enterprise networks through IKEv2 drafts and X.509 certificate profiles; every protocol family—DNSSEC, S/MIME, SSH, code signing, blockchain systems—needs its own belt, and each moves at committee speed.

Frontier Measurement infrastructure is the field’s instrumentation. Almost everything quantitative known about this migration comes from a handful of vantage points—CDN telemetry, browser dashboards, scanning projects. That the best public data on a civilisation-scale transition is a vendor blog is itself a finding about scientific infrastructure.

Frontier The decisive experiment is cryptanalysis of the deployed assumptions, and it is already running. The single result most able to change this assessment is a practical attack on the module-lattice problems beneath ML-KEM and ML-DSA. The 2022 break of SIKE showed what such an event looks like: a scheme that had survived years of public review fell to a classical attack running in about an hour on a single core. A comparable result against module lattices would invalidate the migration’s core bet—ML-KEM and ML-DSA carry essentially all deployed post-quantum traffic—and force SLH-DSA and HQC to absorb the load under emergency conditions. Short of a full break, a sustained pattern of papers shaving bits off lattice security estimates would force parameter escalation and reopen every size-versus-performance bargain that made deployment tolerable.

Established Quantum factoring records are the public calibration instrument, currently pinned at zero. Any genuine Shor-style factorisation meaningfully beyond 21—let alone a 100-bit RSA modulus—would be the cleanest possible recalibration of every timeline in this brief. Tracking error-corrected logical-qubit counts and fidelities is the continuous version of the same observation; both are published, contestable, and free of survey psychology.

Frontier The 2030–2035 deadline cluster is a natural experiment in institutional migration speed. CNSA 2.0’s 2033 exclusivity date, NCSC’s 2031 and 2035 gates, and the US federal 2035 disallowance will each produce a compliance record. Whether they hold, slip quietly, or are formally relaxed will measure something no survey can: what a security deadline is actually worth against a threat with no confirmed arrival date.

Established Telemetry thresholds are the migration’s running measurements. Origin-server share (10% in early 2026), the first browser-trusted post-quantum certificate (expected 2027 at the earliest), and post-quantum DNSSEC are all observable milestones with dates that will either arrive or not.

Speculative A harvesting disclosure would convert the field’s central inference into evidence. Declassification, defection, or breach revealing an actual store-now-decrypt-later archive—its scale, targets, and curation—would settle the evidentiary argument overnight. Nothing schedules such a disclosure; the record here may stay dark indefinitely, which is itself worth stating.

Frontier Two nearer engineering verdicts are dated: whether FN-DSA implementations survive open side-channel review when FIPS 206 lands, and whether HQC’s 2027 finalisation produces a deployable code-based fallback or a paper hedge nobody ships. Both will be answered this decade.

Frontier The lasting engineering deliverable is cryptographic agility, not any particular algorithm. Systems that treat algorithm identifiers, key sizes, and certificate chains as negotiable runtime properties—rather than compile-time constants—survived this transition cheaply; systems with 32-byte fields hardcoded did not. Building agility into protocols, hardware abstraction layers, and procurement language is the work that makes the next migration boring.

Established Hybrid construction is a solved engineering pattern with a precise guarantee. Deployed hybrids derive the session secret from both an X25519 share and an ML-KEM share through a key-derivation function, so an attacker must break both. The cost—one extra kilobyte and measured single-digit-percent latency—bought insurance against exactly the SIKE-class surprise the field had just witnessed.

Frontier Constrained devices set the hard edge of feasibility. ML-KEM runs acceptably on commodity microcontrollers; ML-DSA verification is manageable but signing strains RAM budgets; SLH-DSA’s 7.9-kilobyte signatures exceed entire message budgets on some industrial and satellite links. Signal’s SPQR shows the craft required at scale: erasure-coding key material across messages so kilobyte-scale objects ride a chat protocol without users noticing.

Frontier Root-of-trust replacement is ceremony engineering as much as cryptography. Rotating a certificate authority’s root or a code-signing anchor requires validated HSM firmware, auditable key ceremonies, and years of overlap while old and new chains coexist. Stateful hash signatures add a novel hazard: reusing an LMS or XMSS state once is catastrophic, so state management—trivial in theory—becomes a safety-critical hardware discipline.

Established The tail requires update paths that outlive their vendors. Devices fielded today with 20-year lives must either carry post-quantum verification now, or carry an upgrade mechanism whose own security does not depend on the algorithms being retired. That recursive requirement—the update channel must migrate before the payload—is why firmware signing came first in every serious national plan.

Established Quantum key distribution is adjacent, marketed as a substitute, and rejected as one by the agencies that matter. The NSA and the UK NCSC both advise against QKD for national security systems: it needs dedicated hardware and short ranges, does not authenticate, and solves only key transport. Post-quantum algorithms on ordinary hardware are the recommended path; QKD remains a physics programme, not a migration plan.

Frontier Quantum computing itself is the pacing adjacent technology, and its milestones—not its promises—belong in migration planning. Logical-qubit demonstrations and falling resource estimates feed directly into the deadline debate; everything else about the industry is noise from this brief’s vantage.

Frontier The nearest neighbours on this map are institutional, not physical. Cryptography is the invisible utility beneath infrastructure resilience: the grid, payments, and logistics inherit whatever floor this migration sets, and autonomous supply chains presume machine-to-machine identity that must survive the transition. The governance problem—regulating a fast-moving technical risk through slow institutions on a contested timeline—is structurally the same one examined in AI governance. And any regime that enforces rules in code, as explored in digital constitutional systems, stakes its constitution on signatures that a CRQC would forge.

Established A US standards agency became, de facto, the world’s cryptographic legislature. The NIST competition’s openness—public submissions, public breaks, published rationale—is why its outputs are being adopted far beyond US jurisdiction, and it was designed partly to rebuild the trust burned by the Dual_EC_DRBG affair. Standards credibility is an institutional asset with a measurable half-life.

Frontier That hegemony is fraying at the edges. China is running its own post-quantum standardisation rather than adopting NIST’s suite; European agencies diverge from the NSA on hybrids; sectoral regulators are writing their own compliance clocks. A world of interoperable-but-plural cryptographic regimes is the likely 2030s condition, with all the border friction that implies.

Established The fastest levers in the record are concentrated private ones. Two browser vendors, three TLS libraries, and a handful of CDNs moved half the web’s key agreement in two years; browser root programs and the CA/Browser Forum will decide certificate migration pace similarly. Public deadlines matter mostly as procurement pressure on that concentrated layer—the US statute works by making inventories and migration a condition of selling to government.

Frontier Historical base rates say cryptographic migrations take one to two decades even with working replacements. SHA-1 went from theoretical weakness (2005) to demonstrated collision (2017) to final browser removal in about fifteen years; 3DES and TLS 1.0 retirements ran similarly. The post-quantum key-agreement leg beat those base rates badly; the certificate and embedded legs are currently tracking them. Institutions that must hold a programme steady across four electoral cycles are the real dependency—the problem this site examines in long-term institutional design.

Frontier Workforce is a quiet constraint. The number of people who can safely implement a lattice KEM in constant time is in the low hundreds worldwide; the number who can run an HSM key ceremony to audit standard is smaller. Every national plan implicitly assumes this labour pool scales. None explains how.

Frontier Harvest-now-decrypt-later is a human-rights problem before it is a compliance problem. The traffic most worth archiving cheaply today is that of journalists, dissidents, diaspora communities, and their sources—people whose risk horizon is their lifetime, not a data-retention schedule. Migration speed on messaging platforms is therefore an ethical variable: Signal’s and Apple’s early moves protected exactly the populations least able to wait for procurement cycles.

Established Protection is stratifying by budget. Flagship platforms migrated key agreement in 2023–2025; small hospitals, municipal utilities, legal-aid clinics, and most of the Global South will migrate last, on vendor timelines they do not control. The confidentiality of a medical record now depends measurably on which country and which vendor holds it.

Frontier Data lifetimes make today’s choices retroactively judged. Genomic data implicates relatives across generations; state archives carry 50–100-year declassification horizons; a child’s health record must outlast any plausible CRQC estimate. Institutions holding such data and still negotiating classical key exchange in 2026 are making a bet their data subjects never consented to.

Speculative Transitions invite exceptional-access pressure. Every previous cryptographic inflection—key escrow in the 1990s, the going-dark debates of the 2010s—saw states seek access mechanisms during the churn. Nothing in the FIPS process shows such a mechanism, and its openness is the strongest available evidence against one; the risk worth naming is that some national migrations, conducted less publicly, could couple post-quantum upgrades with lawful-access mandates.

Frontier This migration sets the expiry structure of a civilisation’s secrets. Everything encrypted under classical key exchange and intercepted forms a stratum whose confidentiality ends the day a CRQC runs; everything after migration does not. Societies are currently laying down the boundary between those strata, mostly without noticing, at a rate measurable in CDN dashboards.

Speculative It is the largest infrastructure replacement ever attempted with success defined as nobody noticing. The trust layer is being rebuilt while carrying full load—the ship rebuilt at sea. If it works, the historical record will show only a line on a telemetry graph; the interesting civilisational question is whether institutions can learn from a catastrophe that was averted invisibly.

Frontier As a precedent, it is the cleanest existing case of global pre-emptive risk mitigation against an unscheduled threat. A standards body, open adversarial review, public telemetry, and deadline clusters moved half the world’s handshakes before the threat exists. The pattern—not the specifics—is exportable to other slow-motion risks, though analogies to climate or pandemic preparedness are loose: cryptographic migration has a cheap unilateral fix and no distributional losers of comparable scale, which is precisely why it is easier.

Speculative The failure mode is chronic, not apocalyptic. A CRQC arriving in the early 2030s against an 80%-migrated world would not collapse the internet; live traffic would already be safe. It would open a long tail of retrospective exposure—archives read, old signatures forged until revocation catches up, legacy fleets exploited—a decade of corrosion concentrated on whoever migrated last.

These horizons track the migration’s measurable legs—key agreement, certificates, embedded fleets—against the deadline cluster and the surveyed CRQC distributions; the attack date itself stays speculative throughout.

• 10 yr: Frontier Post-quantum key agreement effectively universal on the public web and enterprise VPNs; browser-trusted post-quantum certificates mainstream after a 2027-ish start; the CNSA 2.0 (2033) and US federal (2035) deadlines produce substantial but visibly incomplete compliance, with formal slippage in at least some sectors; the embedded tail barely dented. Survey medians imply a CRQC this decade is possible but not the central case—planning that assumes either certainty is unsupported.
• 25 yr: Speculative Expert distributions place a CRQC at better-than-even odds well before 2051; if so, the story becomes retrospective exposure of harvested archives and forged legacy signatures on the unmigrated tail, not live-traffic collapse. HQC-class fallbacks and a second signature generation either sit ready or the monoculture bet is being re-litigated under pressure.
• 50 yr: Speculative Either cryptographic agility has made algorithm replacement routine maintenance—the migration’s true success condition—or degraded lattice confidence has forced a second forced march through the same institutions, this time with the playbook written.
• 100 / 250+ yr: Handwave Nothing about the mathematics, hardware, or institutions of that horizon is forecastable from here; the only defensible long claim is the pattern itself—a civilisation that keeps secrets must periodically re-key everything it owns, and the institutions that can do so calmly are the asset worth building.

• Depends on Nothing on this map blocks it—and notably, its threat driver (large-scale quantum computing) has no brief here, because the migration proceeds on the possibility rather than the machine. It is upstream of most digital topics on the map rather than downstream of any.
• Requires (not on this map) Certificate authorities need FIPS-validated HSM firmware implementing ML-DSA before any post-quantum Web PKI exists; browser root programs must then accept and require post-quantum certificates; FIPS 140 validation queues must clear post-quantum modules at a rate matching the deadlines; chipmakers must ship volume silicon whose secure-boot ROMs verify post-quantum signatures; buyers must write procurement terms that actually pay for cryptographic inventory and agility rather than assuming them; and the whole bet stays sound only while sustained worldwide cryptanalysis keeps failing to break structured lattices.
• Enables Durable confidentiality and authentication for everything downstream of it: long-lived records, machine identity, payment rails, and any governance system whose rules are enforced cryptographically. A completed migration converts “quantum computing breaks the internet” from a civilisational risk into a historical footnote.
• Adjacent Infrastructure resilience treats the utilities this migration silently underpins; digital constitutional systems stake code-enforced rules on the signature schemes chosen here; AI governance wrestles the same slow-institutions-fast-risk geometry; and long-term institutions studies the organisational stamina a 2035 deadline quietly presumes.

Handwave “Q-day is 2030” (or any named year). No measurement supports a date. The best available instrument—expert surveys—returns wide distributions from small samples (26 respondents in 2025, none from China), and its medians have moved by years between editions. Deadlines like 2033 and 2035 are policy constructions chosen to force action under uncertainty, not predictions; treating them as forecasts reverses their logic.

Handwave “Quantum computers will break all encryption.” Established Shor’s algorithm breaks deployed public-key systems; Grover’s only halves symmetric security exponents, so AES-256 and modern hashes stand. The apocalypse framing obscures the actual, bounded, and fixable exposure—which is precisely what the migration is fixing.

Handwave “A quantum computer has already factored RSA-sized numbers.” Recurring headlines rest on annealing demonstrations against specially structured integers, or on hybrid claims that do not scale. Genuine Shor-style factorisations remain at 15 and 21. No cryptographic key of any real system has ever been broken by a quantum computer.

Frontier “There is no evidence anyone is harvesting, so there is no urgency.” Half true, and the half matters: no public evidence documents a curated decrypt-later archive. But bulk interception capability is documented history, storage is cheap, and the cost of being wrong is retroactive and irreversible—an asymmetry the deadline cluster prices in. The honest position holds both: the specific claim is unproven; the hedge is cheap and already half-executed.

Handwave “Quantum key distribution solves this.” The NSA and NCSC—agencies with every incentive to deploy working exotica—recommend against QKD for their own systems: no authentication, special hardware, short range. Post-quantum algorithms on existing hardware are the solution those agencies chose.

Handwave “The new algorithms are proven secure.” No deployed cryptography has unconditional proofs; security is conjectured hardness plus survived scrutiny. SIKE survived five years of expert review and died in an afternoon of the right idea. That is why hybrids ship, why SLH-DSA and HQC exist, and why this brief flags lattice confidence as frontier rather than established.

Handwave “It’s just a software update.” For a browser, nearly. For the world: HSM firmware and audited ceremonies, FIPS validation queues, silicon boot ROMs on decade cycles, satellites, implants, and inventories nobody has finished compiling—against a floor estimate of US$7.1 billion for one government’s civilian slice alone. The 60%-of-web-traffic figure measures the easiest tenth of the problem.

Frontier “Hybrid is wasteful belt-and-braces.” This is the NSA’s stated position, and it is a minority one: BSI, ANSSI, and effectively the entire deployed internet chose to pay one kilobyte for insurance against a SIKE-class surprise in lattices. The disagreement is real, declared, and worth watching—whichever side proves right will shape how the next algorithm generation deploys.