Post-quantum trust has a certificate gap.
Deck: A post-quantum transition can begin in key exchange before certificate authentication, asset inventories, procurement routines, and migration receipts catch up.
The signal
A recent measurement study of post-quantum readiness points to a split transition: parts of the web can begin supporting hybrid post-quantum key exchange while certificate-based authentication remains classical. That matters because a user can see a connection as secure while the deeper institutional work of inventory, ownership, renewal, and proof is still unfinished.
Why this is hypernovelty
Read this as adaptation lag rather than quantum panic. Standards can move, browsers can test, CDNs can deploy, and researchers can measure progress before ordinary organizations know where their certificates, signatures, keys, libraries, vendors, and long-lived encrypted records actually live.
The adaptation burden
- Security teams need cryptographic inventories that are specific enough to act on.
- Procurement teams need vendor answers that go beyond “we are monitoring the standards.”
- Legal and compliance teams need evidence of migration work while avoiding fake guarantees.
- Operators need test windows and rollback plans before trust-layer changes are urgent.
Plain-language companion
The Fast Now version would be simpler: “The lock can be upgraded before the paperwork knows it changed.” HN keeps the technical ledger; The Fast Now explains why normal readers should care.
One Signal Atlas forecast
Public proof / calibration record
By June 30, 2027, will at least one major browser, CDN, or certificate authority publish a public roadmap that distinguishes post-quantum key exchange readiness from post-quantum certificate/signature readiness?
Yes — 65%. The answer leans yes because transport-layer work is already visible, while authentication and certificate readiness need separate public coordination.
A public roadmap or standards-facing update from a major browser, CDN, or certificate authority that explicitly separates key exchange readiness from certificate/signature readiness.
Resolve or update on June 30, 2027. Update earlier if a qualifying roadmap appears or if major ecosystem actors publicly abandon the distinction.
Why this question: It is observable, time-bound, and tied to the adaptation gap this article describes. Evidence that would update the answer includes public CA roadmaps, browser security posts, CDN deployment notes, or procurement guidance that separates transport encryption from authentication.
Reader question
If your organization had to produce a cryptographic inventory this quarter, who could answer where certificates, signatures, keys, libraries, vendors, and long-lived encrypted records actually live?