Signatures Are the Long-Tail Quantum Risk
The "harvest now, decrypt later" argument drove the first wave of post-quantum urgency, and it applies to confidentiality. Digital signatures carry a different, slower-burning risk: integrity that must hold for years.
A firmware image signed today may still be validated in 2040. A signed legal record, an audit trail, a software bill of materials, a long-lived device identity — each depends on a signature remaining unforgeable for its entire retention period. If the signing algorithm falls, everything ever signed with that key becomes disputable retroactively.
Cloud key management platforms have begun offering NIST-standardised quantum-safe signing keys, which moves this from a research topic to a procurement decision.
The Two Standardised Signature Families
ML-DSA (FIPS 204)
A lattice-based scheme, and the general-purpose default. Signing and verification are fast, key sizes are manageable, and it is the right choice for high-volume signing: TLS authentication, token issuance, API request signing, and most certificate hierarchies.
SLH-DSA (FIPS 205)
A hash-based scheme whose security rests only on the strength of the underlying hash function — the most conservative assumption available. Signatures are large and signing is slow, which makes it unsuitable for high-throughput use, but ideal for infrequent, ultra-long-lived roots of trust: offline root CA keys, firmware signing keys, and archival integrity anchors.
The practical enterprise pattern is to use both: SLH-DSA at the root, ML-DSA for everything issued underneath it.
What Managed Quantum-Safe Signing Actually Solves
- No custom crypto implementation. PQC algorithms are unforgiving of implementation error; using a validated managed implementation removes an entire class of risk.
- Hardware-backed key custody. Keys stay non-exportable, with the same access controls and audit logging as classical keys.
- Incremental adoption. New key versions can be introduced alongside existing classical keys, so verification infrastructure can be updated before signing is switched over.
What It Does Not Solve
Managed signing keys give you an algorithm; they do not give you a trust model. You still own:
- Verifier readiness. A quantum-safe signature is worthless if the systems validating it do not recognise the algorithm. Verification support must be deployed before signing changes.
- Size and performance impact. Larger signatures affect artifact sizes, manifest formats, embedded device storage and handshake latency. Constrained systems need testing, not assumptions.
- Certificate and chain policy. Which keys get quantum-safe signatures, in what order, with what validity, chained to which root — this is PKI governance, and no key store makes those decisions for you.
- Crypto-agility. The goal is not "migrate to ML-DSA once." It is being able to change signature algorithms again without re-architecting, because standards will continue to evolve.
A Sensible Adoption Order
- Classify by signature lifetime. Anything whose validity must outlast 2035 is in scope now: firmware, roots of trust, long-retention records.
- Deploy verification first. Update validators, agents and clients to accept PQC signatures while still trusting classical ones.
- Dual-sign during transition. Produce both a classical and a quantum-safe signature so old and new verifiers both succeed.
- Anchor new hierarchies conservatively. Use a hash-based root with lattice-based issuing keys.
- Retire classical-only signing once telemetry shows every verifier handles the new algorithm.
The Governance Point
Quantum-safe signing keys are now available on demand. The bottleneck is no longer cryptographic availability — it is knowing which signatures your business depends on, how long each must remain trustworthy, and who owns the rotation.
That inventory is the deliverable. Everything else is configuration. For the broader programme view, see our guidance on enterprise PKI modernization and post-quantum readiness.