Post-quantum signatures still lag far behind encryption, MITRE finds

No post-quantum hardware Trusted Platform Module (TPM) is on sale. That is one of the findings of a report by MITRE, the American nonprofit research organization that runs federally funded centers. The report, dated September 2026, was made public on October 15 by the Post-Quantum Cryptography Coalition. It takes stock of post-quantum migration across eight families of enterprise technology. Yet the TPM is a common hardware root of trust, required by some operating systems and networks.

The result can be summed up in one sentence: post-quantum encryption is available almost everywhere, while digital signatures are far less so. The data was collected in July 2026, then peer-reviewed in August and September.

Six maturity levels, none at the top

MITRE distinguishes two uses. On one side, confidentiality: key exchange, which protects data against future decryption. On the other, authentication: signatures, which prove a server's identity or a piece of software's origin. Each technology is given a level on a scale that runs from “blocked” to “validated integration.” That last level requires a FIPS 140-3 certified module. None of the eight families reaches it.

For confidentiality, five of the six families concerned reach the “integration” level, meaning a public, ready-to-use version: browsers, web servers, VPNs, public key infrastructures (PKI) and connections to cloud services. Only disk encryption remains at the “components available” stage.

For signatures, only two of the eight families reach that level: code signing and PKI. Browsers, web servers, VPNs, secure boot and disk encryption have only components. Cloud connection goes no further than preliminary integration, based on an experimental ML-DSA deployment.

Where things get stuck in practice

In browsers, the hybrid X25519MLKEM768 key exchange is widely available, often enabled by default. However, MITRE found no mainstream browser able to validate an X.509 certificate signed with a post-quantum algorithm. It also found no common support for ML-KEM-1024 or for a purely post-quantum key exchange. On the web server side, post-quantum authentication still relies on custom-recompiled builds, notably with the OpenQuantumSafe library.

For VPNs, several products use a standardized hybrid key exchange (IKEv2 with RFC 9242 and 9370). Endpoint authentication, however, is not yet integrated. As for secure boot, measured boot and attestation, MITRE found no post-quantum integration in mainstream solutions.

The report acknowledges its limits. It relies on vendors' statements and “should not be interpreted as an independent assessment of product security.” It also does not distinguish hybrid deployments from purely post-quantum ones.

What you can do right now

This gap is good news for setting priorities. The “harvest now, decrypt later” threat targets confidentiality, and that is precisely the part that is available. Enable hybrid key exchange on your TLS servers and VPNs, for example with the help of the settings published by the United Kingdom. For signatures, start with an inventory and with tests of your certificate chains, as Microsoft urges companies to do. When you renew your PCs and equipment, ask suppliers for their post-quantum roadmap for TPMs.

MITRE plans to extend its analysis to other technologies in upcoming editions. The next report will show whether post-quantum signatures are making progress or remain the main laggard of the migration.