Post-quantum cryptography is moving from research and standardisation into practical deployment. The BLimPQC project shows that the main challenges are no longer limited to selecting new algorithms. They also concern how those algorithms are integrated into infrastructures, protocols, devices, supply chains and use cases shaped by regulation. Crypto-agility and PKI readiness are therefore essential for a controlled transition to quantum-safe security.
Post-quantum cryptography (PQC) has moved from being primarily a research and standardisation topic to becoming a practical migration challenge. Only a few years ago, discussion focused on which algorithms would be selected and when they would be standardised. NIST has now published its first PQC standards, and they are ready for implementation. Attention is shifting to updating cryptographic infrastructures, protocols, certificates, devices and organisational processes for the quantum-safe era.
The BLimPQC project has examined this change from the perspectives of both standardisation and regulation. Its results show that the PQC transition is not simply an algorithm replacement. It is a long-term infrastructure transformation shaped by complex dependencies.
In March 2026, Google set 2029 as the target for its own PQC migration, citing developments in quantum hardware, error correction and resource estimates. At the same time, discussion of quantum risks to cryptocurrencies has made it increasingly visible that trust built on classical cryptography cannot be treated as a permanent assumption. This does not mean that today’s cryptography will become unusable tomorrow, but that preparations must begin before the quantum threat materialises.
NIST’s main standards are ready, while alternatives continue to be developed
A major milestone in PQC standardisation was the publication of NIST’s first standards in August 2024. FIPS 203 specifies the ML-KEM key-encapsulation mechanism, FIPS 204 specifies the ML-DSA digital signature algorithm, and FIPS 205 specifies the hash-based SLH-DSA digital signature algorithm. FN-DSA, based on Falcon, has been selected for standardisation as FIPS 206.
NIST has also selected HQC for standardisation as a second PQC key-encapsulation mechanism. HQC is not intended to replace ML-KEM, but to complement it. Its main value lies in algorithmic diversity: ML-KEM is based on structured lattice problems, whereas HQC is based on code-based cryptography. A different mathematical foundation provides an alternative if an unexpected cryptanalytic weakness is later found in the primary KEM.
NIST is continuing its evaluation of additional quantum-resistant digital signatures to complement the already standardised schemes with different mathematical assumptions, smaller signatures or different performance characteristics. This is particularly relevant in PKI environments, where the size of certificates, signatures and trust chains directly affects the feasibility of deployment.
Organisations should therefore not wait for every alternative standard to be completed. The focus is shifting from algorithm selection to crypto-agility, interoperability and controlled deployment. Algorithms must still be integrated into protocols, libraries, certificates, hardware security modules, operating systems, browsers, cloud services and sector-specific standards.
PKI is a critical junction in the PQC transition
One of the most important practical questions concerns public key infrastructure (PKI), which underpins many digital trust chains. PKI binds keys to identities, enables certificate issuance and revocation, and supports secure connections, device management and software signing.
A quantum-safe PKI cannot be created merely by replacing a classical RSA or ECDSA signature with ML-DSA. Decisions are needed on whether the transition should use hybrid certificates or separate classical and PQC certificates, how certificate chains can be updated without breaking connections to existing systems, how trust anchors and key-management systems will support PQC keys, and how certificate lifecycles, renewal, revocation and auditing will work while several algorithms coexist.
The PKI challenge is not solely technical. It also concerns trust, governance and interoperability. Global services, international certificate ecosystems, national requirements and sector-specific schedules may not progress at the same pace. Regulation is regional, while PKI trust chains cross national borders.
The PKI transition is more than an algorithm replacement
PQC certificates present a practical problem: size. In today’s Web PKI, classical signatures are relatively small. PQC signatures and public keys are often considerably larger, potentially increasing TLS handshake latency and reducing connection reliability, particularly in constrained networks and devices.
This is why new approaches such as Merkle Tree Certificates have emerged in Web PKI discussions. Rather than having a certification authority sign each certificate separately with a large PQC signature, a large set of certificates is bound to a Merkle tree whose root is signed. An individual certificate is accompanied by a compact proof showing that it belongs to the signed set.
Such approaches move the discussion from a single algorithm to the overall PKI architecture. They may reduce TLS handshake overhead, but they also raise new questions: how should signed tree-root information, inclusion proofs and update channels be distributed securely; how can interoperability be achieved across different environments; and how can the approach be standardised without fragmenting the Web PKI?
From the BLimPQC perspective, MTCs are a useful example of why the PQC transition requires both cryptographic research and practical systems engineering. Quantum safety cannot always be achieved simply by adding larger signatures to existing infrastructure. In some cases, the trust architecture itself must be reconsidered.
Crypto-agility is an essential capability
The PQC transition is closely linked to crypto-agility. This means the ability of systems, organisations and processes to replace, update or remove cryptographic mechanisms in a controlled manner without extensive redesign.
This capability matters because the transition will proceed in stages, and because PQC algorithms may eventually become obsolete or prove unsuitable for particular use cases. Classical, PQC and, in some cases, hybrid mechanisms will coexist for a considerable period.
Crypto-agility requires a cryptographic inventory. An organisation must know where cryptographic elements are used, from algorithms and protocols to certificates, hardware security modules, signature chains and device-specific keys. One approach is a Cryptographic Bill of Materials (CBOM), which makes cryptographic dependencies visible and manageable. VTT has invested in crypto-agility research and helped organisations improve visibility into their cryptographic assets.
PQC transition is being shaped by regulation and official guidance
According to the BLimPQC regulatory review, the EU does not yet have a specific PQC regulation. However, NIS2, the Digital Operational Resilience Act, the Cyber Resilience Act, the General Data Protection Regulation, rules for EU classified information and national cybersecurity strategies create indirect requirements for appropriate and risk-based cryptography. Under the EU PQC roadmap, Member States should initiate national transition strategies by the end of 2026, high-risk use cases should migrate by the end of 2030, and the broader transition should be completed as far as feasible by the end of 2035.
The United States has taken a more binding approach for federal systems, requiring cryptographic inventories and PQC migration planning. These requirements also affect suppliers that wish to serve government, defence or critical-infrastructure customers.
In Finland, the PQC transition is linked to the EU roadmap, national cybersecurity and security of supply. Traficom and Finland’s national cryptography working group have stressed the need to begin the transition, and the national timetable follows the EU milestones for the years 2030 and 2035.
What should organisations do now?
The BLimPQC results suggest that PQC readiness should be built in stages. The first step is a cryptographic inventory: where is quantum-vulnerable public-key cryptography being used?
Next, organisations should prioritise high-risk use cases, particularly information and systems whose confidentiality, authenticity or integrity must remain protected for a long time. Crypto-agility should also be built into the architecture: hard-coded algorithm choices should be avoided, cryptographic interfaces should be designed for replacement, and the maturity of relevant standards should be monitored actively.
PKI changes should be prepared well in advance. In practice, this means reviewing certificate chains, HSM support, certificate profiles, certificate-management processes, key usages and, where appropriate, the interoperability of hybrid solutions. Procurement and supplier requirements must also be considered, since PQC readiness depends on libraries, devices, cloud and certificate services, and software vendors.
The transition is manageable if it starts early
The PQC transition will inevitably take several years. Progress will differ by sector and will be slowed by long system lifecycles, dependencies and broad interoperability requirements. This is precisely why the work should begin before it becomes an urgent crisis project.
The BLimPQC project’s results to date show that standards, policy and technical development are moving in the same direction: quantum-safe cryptography is becoming part of the normal cybersecurity baseline. It will not, however, be delivered by a single software update.
PKI is particularly important because it forms the backbone of digital trust. If certificates, key management and trust chains are not ready for the PQC era, many other technical upgrades will remain incomplete. The central question is therefore not only which algorithm will prevail, but how we can ensure that digital trust continues to hold in the quantum era.
