Cybersecurity

The Quantum Deadline Hiding in Your Certificates

Cloudflare will move its signatures to ML-DSA now rather than wait for NIST's nine new candidates. For owners, the trust layer is the slow half of post-quantum.

CybersecurityBy Servola Tech Desk2026-07-102 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The Quantum Deadline Hiding in Your Certificates

A certificate renewal is now a quantum decision

A security lead renewing a batch of TLS certificates or signing a firmware image is doing a routine job that now carries a quantum-era choice. On 9 July Cloudflare said plainly that it will not wait for better post-quantum signatures and will use ML-DSA, the algorithm standardised last year. It aims to be fully migrated by 2029, ahead of national deadlines that fall between 2030 and 2035.

The reason is timing, not preference. Quantum hardware and the software around it keep advancing, and the migration itself takes years to reach every certificate and device. Starting late, not choosing the wrong algorithm, is the real exposure.

Post-quantum has an easy half and a hard half

Most attention goes to encryption and the harvest-now-decrypt-later threat, where a new key exchange called ML-KEM protects data in transit. That half is already well underway across browsers and servers.

Signatures are the harder half. They authenticate certificates, code, firmware, documents and identity, and they live in certificate chains, embedded devices and long-lived roots that no one swaps overnight. ML-DSA signatures are larger than the ones they replace, and every layer - browsers, libraries, certificate authorities and hardware - has to add support before the move is real.

The better signatures are a NIST round, not a product

NIST advanced nine additional signature candidates - FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV - to a third evaluation round on 14 May 2026, with final tweaks due by 14 August 2026. Several are smaller or faster than ML-DSA on paper.

That round is a two-year study of implementation security and physical attacks. When NIST last picked a signature it still took about a year to draft the standard, another to publish it as FIPS 204, and another for certificate integration. A better signature is therefore a 2029-and-beyond artefact, not a choice you can make in 2026.

What an owner does before the next audit

Start with an inventory of where you sign: TLS certificates, code-signing, firmware update chains, and document and identity signatures. In Europe the eIDAS framework and the coming EU digital-identity wallet both ride on this signing layer, so the surface is wider than most teams assume.

Then adopt ML-DSA where you control the endpoints now, ask vendors and certificate authorities for a dated post-quantum signature roadmap, and treat crypto-agility - the ability to swap the algorithm later - as the deliverable. NIS2 and DORA already expect you to manage exactly this risk.

Frequently asked questions

Is ML-DSA the final answer for post-quantum signatures?

No. It is the one that is standardised and deployable today as FIPS 204. NIST is studying nine further candidates that may be smaller or faster, but they are years from standardisation, so ML-DSA is the working choice now, paired with the ability to change later.

Why are signatures harder to migrate than encryption?

Encryption protects data in transit and can be upgraded at the connection. Signatures authenticate certificates, code and firmware that sit in long chains, embedded devices and trusted roots you cannot replace quickly, so the rollout touches far more of the stack.

What is the regulatory deadline in Europe?

National roadmaps vary - Germany's BSI, France's ANSSI and the UK's NCSC target the 2030 to 2035 window - but NIS2 and DORA already require you to manage this risk, and starting the signature move now is what keeps you inside those timelines.

The encryption clock gets the headlines, but the trust layer moves on a slower gear. The organisations that start signing with ML-DSA this year are the ones that will not be renewing certificates in a panic while the better algorithm is still a draft.

post-quantum cryptographyML-DSANISTdigital signaturesTLS certificatesCloudflarecrypto-agility

This ColdFusion Flaw Was Attacked Within Minutes

A maximum-severity Adobe ColdFusion flaw, CVE-2026-48282, was attacked within minutes of the technical write-up going public. US agencies must patch by 10 July, and the servers most at risk are the forgotten ones still running Remote Development Services.

3 min read

Cybersecurity

One Kernel Patch Will Not Close This VM Escape

CVE-2026-53359, named Januscape, is a 16-year-old flaw that lets a rented virtual machine break out and seize the physical host it shares with other tenants. Closing it needs two separate patches, not one, and patched Linux kernels only shipped on 4 July.

4 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles