Windows Dated Post-Quantum Signing and Left the Algorithm Open
When an English sovereign died, the Great Seal did not stop working. The old silver matrix stayed in use, pressing the same authority into wax, until the new sovereign ordered otherwise; only then was it defaced and a replacement cut. The metalwork was never the difficult part. The difficult part was the ordering — someone had to decide when the old authority stopped being good, the decision had to be announced, and every office relying on the seal had to be told in time, or it would start refusing instruments it should have honoured.
Microsoft has now issued that order for one of the largest software estates in the world. It has fixed the dates and left the most important detail blank.
A date, and no algorithm
The guidance of 20 August 2026, Preparing the Windows ecosystem for next-generation code signing, sets out three steps. The Microsoft Windows Production PCA 2011 expires on 19 October 2026, with a replacement authority already rolling out. Signing moves to RSA-3072 and SHA-384 by the end of 2026. And in 2027, Windows signing transitions to post-quantum signing, which the document says might use hybrid signature constructions. What it does not do is name a post-quantum algorithm. It commits to a date and a direction and leaves the scheme open.
The operational payload is the instruction attached to the schedule. Applications are told not to pin Microsoft certificate subjects, issuers, thumbprints, serial numbers or intermediate authorities, not to require SHA-256 or RSA-2048 specifically, and not to parse Authenticode chains by hand. They are told to call WinVerifyTrust or the appropriate CryptoAPI chain and policy interfaces and to ask one narrower question: does Windows trust this signature. Anything that answers a wider question from hardcoded strings is the thing that breaks — and because the replacement authority is rolling out now, it can break before October.
It is worth being precise about what this layer does, because the shorthand overstates it. A code signature establishes publisher identity, integrity, and the trust inputs a platform reasons over; it does not by itself grant software the right to run, since execution also depends on platform policy and on whatever an organization has configured. But it is the foundation those later decisions rest on. The imaging workstation in a radiology department, the head unit in a car, the laptop a municipal clerk uses to open a resident's file — none of them verify anything themselves. Each relies on a chain that begins with a private key held by someone the user will never meet, and on that chain being replaceable if it fails.
Windows is not the only large supply chain with a date attached. JDK 27, scheduled for general availability on 15 September 2026, ships JEP 527, post-quantum hybrid key exchange for TLS 1.3. That is the key-agreement half, which has been the more tractable half throughout. Signatures are the half still waiting on a compact, web-suitable option.
Practical takeaway. The Windows signing chain is changing now, not only in October. With the replacement certificate authority already rolling out, software that pins Microsoft certificate subjects, issuers, thumbprints, serial numbers or the SHA-256/RSA-2048 pair can begin rejecting files that Windows itself correctly accepts during the rollout — ahead of the 19 October 2026 expiry, and years ahead of any algorithm decision.
The bench that is supposed to supply the answer
The obvious place to look for candidates is NIST's additional digital signatures programme, though neither Microsoft nor NIST has tied the two together, and Microsoft's document does not mention it. The programme's purpose is often described loosely as a search for smaller signatures; that is the secondary aim. The programme exists chiefly to diversify the portfolio beyond structured-lattice constructions, so that a single mathematical assumption does not carry every signature in use, and secondarily to find short signatures and fast verification for applications that need them.
Nine candidates advanced to the third round on 14 May 2026: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV. NIST's page now carries an update dated 29 July 2026 recording that the HAWK development team withdrew its algorithm, following Anthropic's publication, one day earlier, of an attack its model had found against the scheme. Quentir has covered that episode and its consequences for assurance in detail — the withdrawal itself and what machine-assisted cryptanalysis does to the assurance a standards round buys — and the relevant fact here is only the arithmetic. A programme whose first purpose is diversification is one candidate lighter than when the round opened — though HAWK was itself a lattice-based scheme, so its withdrawal reduces the candidate count without by itself narrowing the range of assumptions on the bench. The reported six-figure marginal API cost of that one experiment establishes feasibility for a well-resourced research team. It does not establish a general price for cryptanalysis, and Anthropic documents substantial human work and validation around the result.
The remaining eight do not obviously fill the blank either. Cloudflare's engineering analysis of 9 July 2026 walks the whole bench and finds every candidate trading one scarce resource for another: SQIsign compact, at 148-byte signatures and 65-byte keys, but slow and hard to implement in a timing-safe way; UOV's 96-byte signature paid for with a 66,576-byte public key; and the multivariate family down roughly fifteen bits at the 128-bit level after the 2025 wedge attacks (eprint 2025/1143), with a 2026 follow-up (eprint 2026/298) recasting the technique as a special case of intersection attacks already known. Cloudflare's conclusion is in its title — ML-DSA will have to do — and it is targeting 2029 for full post-quantum coverage on that basis.
Supervisors will sit inside the test
Against that background, the announcement of 24 August 2026 is small in scale and unusual in shape. The Responsible Fintech Institute, convening from Singapore, and the custody-technology firm Safeheron announced a cross-regional pilot: a multi-party computation protocol supporting ML-DSA-65, the NIST FIPS 204 parameter set, to be tested through wallet generation and on-chain transfers on NEAR's quantum-resistant testnet. Bison Bank will participate, with chief executive António Henriques named on the record. Three supervisors will take part initially as observers — the Abu Dhabi Global Market, the Gelephu Financial Services Office under managing director David Peters, and the Malta Financial Services Authority, represented by Alan Decelis, its head of supervisory ICT risk and cybersecurity. A research whitepaper is planned, and Safeheron says the protocol will eventually be open-sourced for independent audit.
None of it has run yet, and the announcement is careful to say so. The algorithm choice is unremarkable by design, since ML-DSA-65 belongs to the same family everything else in this article leans on. What is worth watching is the intended posture: supervisors positioned to observe a protocol as it is exercised. It will be worth returning to when the pilot produces its whitepaper and its code.
How Quentir Reads It
Put the month on one line and the pattern is narrower than it first looks. A vendor calendar fixed to 2027 with the algorithm left open. A standards programme whose first purpose is portfolio diversity, now running one candidate lighter. An infrastructure provider that examined the compact alternatives and committed to the general-purpose standard on a 2029 target. A supervised pilot reaching for that same standard. Only the last two actually select ML-DSA, and Microsoft selects nothing at all, so this is not yet a convergence of assumptions. What it is, stated no more strongly than the record allows: near-term deployment pressure is settling on ML-DSA while the alternatives mature.
The precise claim matters, because the loose version is wrong. ML-DSA is not the only finished post-quantum signature standard — SLH-DSA is final too, and its conservative hash-based construction is well suited to firmware and roots of trust, precisely the places where a different assumption is most valuable. The accurate statement is narrower and no more comfortable: ML-DSA is the only broadly practical general-purpose option for the deployments now being dated, and it holds that position partly because it is finished rather than because it won a comparison.
This is a different failure mode from the ones covered here recently. When we examined a signature scheme whose state cannot be copied, the risk was operational — an ordinary backup habit quietly destroying a security property. When an intrusion set shipped ML-KEM inside a loader, the point was that adoption is not defense. And when a journal cut the estimated quantum cost of breaking elliptic-curve cryptography twentyfold, no migration deadline moved, because deadlines answer to certification calendars rather than to physics. The risk here is structural and unglamorous in the way real systemic risk usually is: a default hardening under a published deadline, ahead of the portfolio diversity the standards programme was created to produce, in a layer of the stack that almost nobody outside cryptography can see.
Every instrument this post cites — the Windows code-signing guidance, NIST's round-three record and its withdrawal note, the on-ramp analysis, the pilot announcement — sits in the same continuously maintained Quentir archive, and the All-access membership is how a reader takes them as one record rather than four disconnected news days, with the earlier coverage they answer to already alongside. Where the migration needs planning rather than reading, the Signature Report carries fixed scope and dated refresh triggers; this post is a read on one month's instruments, not that.
The clerks who defaced a seal matrix understood that replacing an authority is mostly an administrative problem, not a metallurgical one. Windows has set the date for its own replacement and left the die unspecified, and between now and 2027 someone has to fill that blank for an installed base measured in the billions. The question worth asking before the date arrives is not which scheme finally wins. It is who issues the order to re-cut if the chosen one has to be withdrawn, how quickly that order can reach every office that depends on it, and whether anyone has yet measured that interval.
Sources: Microsoft, “Preparing the Windows ecosystem for next-generation code signing”, published 20 August 2026 (Production PCA 2011 expiry 19 October 2026 with a replacement authority already rolling out; RSA-3072 and SHA-384 by end of 2026; post-quantum signing in 2027, which Microsoft says might use hybrid signature constructions; no algorithm named; pinning and WinVerifyTrust guidance). NIST, Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process (programme rationale: diversification beyond structured lattices, with short signatures and fast verification as secondary aims), and “Nine Candidates Advance to the Third Round”, published 14 May 2026 and updated 29 July 2026 (the nine round-three candidates; the HAWK team's withdrawal on 29 July 2026 and the stated reason). Anthropic, “Discovering cryptographic weaknesses with Claude”, published 28 July 2026 (the HAWK-256 result, reported at approximately 60 hours and $100,000 in API cost; disclosure to HAWK's authors in June and to the public NIST mailing list on release). Cloudflare, “Why we cannot wait for better post-quantum signature algorithms”, published 9 July 2026 (SQIsign and UOV size and speed figures; the 2025 wedge attacks, eprint 2025/1143, and the 2026 follow-up, eprint 2026/298; the 2029 target). OpenJDK, JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3, with JDK 27 scheduled for general availability on 15 September 2026. Safeheron and the Responsible Fintech Institute, cross-regional post-quantum security pilot announcement, 24 August 2026 (planned ML-DSA-65 MPC pilot; ADGM, the Gelephu Financial Services Office and the Malta Financial Services Authority initially as observers; Bison Bank; planned whitepaper and eventual open-sourcing), with a same-day trade report in The Quantum Insider. NIST signature standards status, including final FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), per NIST CSRC. Public sources checked 24 August 2026.
Published intelligence, built to inform your own decisions. Published: August 24, 2026.
Published intelligence, built to inform your own decisions. Published: August 24, 2026.