The Post-Quantum Web Arrived as a Platform Setting
When a town replaced an old telephone exchange, thousands of households could wake up on the new switching system without touching the apparatus in their homes. The conversion happened upstream. Subscribers experienced the change, while the engineering decision sat with an operator most of them would never meet.
A similar pattern is emerging in post-quantum cryptography. A website owner can begin serving a TLS 1.3 handshake using hybrid post-quantum key exchange without running a migration program, changing a server or even knowing which key exchange the browser negotiated. This protects key establishment while authentication remains classical; the study observed no successful negotiation of post-quantum signatures. A content-delivery network or hosting platform can flip the setting for many domains at once.
That distinction now has numbers. In a paper submitted on July 31, 2026 and accepted to the ACM Internet Measurement Conference, Nimesha Wickramasinghe, Frank Li, Sanjay Jha and Arash Shaghaghi report the first longitudinal Internet-scale study of post-quantum TLS after NIST standardization. Their measurements cover more than two billion handshakes, one million domains and 11 global vantage points across July 2025, November 2025 and March 2026.
Practical takeaway. Aggregate adoption can rise quickly when shared platforms change a default. That number says little about whether owner-managed systems, public services and long-lived infrastructure have completed their own migration.
The claim: national calendars should shape deployment
The paper begins with a reasonable policy expectation. Governments have published different post-quantum timelines, sector priorities and algorithm recommendations. Earlier deadlines and sharper mandates should, in principle, leave some trace in deployed systems. Countries that prioritize government or critical infrastructure might show more post-quantum TLS in those sectors. Jurisdictions with a 2030 or 2031 horizon might move earlier than those looking toward 2035.
The authors survey policies across eight jurisdictions. They find broad convergence around ML-KEM, the key-encapsulation mechanism standardized in NIST FIPS 203, alongside meaningful differences in parameter choices, hybrid use, scope and timing. The United Kingdom, for example, publishes milestones for discovery and planning by 2028, priority migration by 2031 and completion by 2035. The European roadmap calls for a coordinated transition among Member States.
TLS makes these ambitions measurable because clients can observe what a server negotiates. The study does not inspect private networks, classified systems, VPNs or cryptography at rest. It examines the public web, which is still a vast civic and commercial surface: government portals, banks, healthcare services, retailers, communications platforms and the infrastructure carrying their traffic.
The record: one hybrid became the default
The researchers created a stable panel of 684,494 domains that completed TLS 1.3 handshakes from every vantage point in all three rounds. In July 2025, 31.26 percent negotiated hybrid post-quantum key exchange by default. The share reached 47.37 percent in November and 49.22 percent in March 2026.
The speed is striking. So is the uniformity. Every domain that defaulted to post-quantum key exchange selected X25519MLKEM768, which combines the classical X25519 exchange with ML-KEM-768. Other hybrids appeared as advertised capabilities but never as the observed default. Pure ML-KEM groups were essentially absent, and the study found no successful negotiation of post-quantum signature algorithms.
Policy documents describe a design space. Operational infrastructure chose a lane. Interoperability, browser support and platform defaults appear to have compressed many national recommendations into one common handshake. That can be sensible engineering. It also means that headline adoption figures measure concentration as much as cryptographic readiness.
The unexpected actor: the platform operator
By March 2026, 93.92 percent of observed post-quantum TLS deployments came from configurations the authors classify as potentially managed by infrastructure providers. Only 4.58 percent were potentially owner-managed. Cloudflare and Fastly together accounted for nearly 70 percent of all observed adoption.
This is the paper's most useful institutional connection. The critical variable is deployment agency: who controls the configuration that the public sees. A platform can multiply one engineering choice across thousands of customers. A hospital network, ministry or manufacturer running specialized systems still has to manage its own software dependencies, procurement cycles and compatibility constraints.
The national comparisons carry the same imprint. US and Australian general-domain samples showed about 57 and 53 percent adoption, while France and Germany showed 27 and 16 percent. Yet the relationship with policy timing weakened once the authors controlled for infrastructure composition. Jurisdictions with earlier targets averaged lower observed adoption than those with later horizons. Among owner-managed domains, both groups remained below 10 percent. On Cloudflare, both were above 93 percent.
A citizen reaching a government portal experiences the negotiated connection, regardless of who configured it. Hybrid key establishment either appears in that session or it does not, while the authentication layer can remain classical. Public accountability still depends on knowing whether a ministry completed a deliberate migration or inherited a provider default that covers only the public edge. Those are different achievements, with different failure modes behind the homepage.
Fast enough to disappear into network noise
The study also tests a common engineering concern: whether larger post-quantum messages slow or break TLS in real networks. Across 328,290 domains that negotiated both X25519 and X25519MLKEM768, the median latency difference was 0 milliseconds. More than 90 percent fell within 14 milliseconds. The hybrid exchange added a median 1,176 bytes from client to server and 1,088 bytes in the return direction, but ordinary network variation masked the timing cost.
That finding is bounded. The measurements came from well-provisioned cloud vantage points and public HTTPS services. They do not erase the bandwidth, battery and loss constraints examined in Quentir's earlier analysis, Post-Quantum Security Has to Survive the Radio. A data-center path and a remote sensor live under different physical budgets. Together, the studies show why a single claim about post-quantum performance is too coarse.
A new lock can sit beside old doors
Post-quantum deployment also failed to produce a uniform improvement in the rest of TLS security. Provider-managed post-quantum domains often had better certificate automation, including more OCSP stapling and fewer hostname mismatches. They also retained more TLS 1.0 and 1.1 support and more deprecated cipher suites than matched classical domains. The platforms were adding a new capability while preserving backward compatibility.
Owner-managed adopters showed a somewhat stricter profile, with lower rates of older protocols and deprecated ciphers. The result is a warning against treating a quantum-resistant handshake as a general security seal. New cryptography can inherit old protocol habits. Migration quality depends on the surrounding configuration, certificate practice and operating context.
How Quentir Reads It
The post-quantum transition has acquired a market-structure dimension. Shared platforms can deliver protection faster than institution-by-institution programs, much as an exchange upgrade once changed telephone service for a whole district. That speed is valuable. It also concentrates influence over algorithm choice, timing and compatibility in a small group of infrastructure companies.
This sharpens the distinction in Quentir's reading of the Swiss migration calendar. A dated roadmap can govern the work an institution owns. Public-web measurements show how much visible progress may arrive through a dependency instead. Both belong in the same account, because inherited protection and controlled migration answer different questions.
The paid Signature Report, the PQC Migration Roadmap, adds fixed scope, a decision checklist, a dated source spine and an organization-wide internal-use license. This public analysis stays with the new measurement result and its infrastructure implication; it does not reproduce the report's migration architecture.
The next phase will expose the long tail. Platform defaults have already shown how quickly a common hybrid can spread. Government services, private infrastructure and specialized networks will show whether national calendars can reach systems that no upstream switch can change for them. The percentage may rise before institutional control catches up.
Sources: Nimesha Wickramasinghe, Frank Li, Sanjay Jha and Arash Shaghaghi, “Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment” (arXiv:2607.29005v1, submitted July 31, 2026; accepted to ACM Internet Measurement Conference 2026); National Institute of Standards and Technology, FIPS 203, “Module-Lattice-Based Key-Encapsulation Mechanism Standard” (August 13, 2024); UK National Cyber Security Centre, “Timelines for migration to post-quantum cryptography” (published March 20, 2025); European Commission, “A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography” (June 23, 2025). Public-source snapshot: August 3, 2026.
Published intelligence, built to inform your own decisions. Published: August 3, 2026.