Google's Post-Quantum Roadmap Puts Traditional Digital Certificates Under Pressure

The 2029 deadline is six years ahead of NIST's guidance and two years ahead of the NSA's requirement for national security systems. The report says the most significant of the three domains is Google's attempt to enhance foundational capabilities for cryptographic agility: building flexible systems that can adopt new cryptographic standards with minimal engineering effort as those standards evolve. The message is that organizations should prepare for a future in which standards, certificate formats, and operational requirements continue to evolve regularly, requiring cryptographic agility. The report notes that Jason Soroko is SVP of Product at Sectigo.

Quantum risk is already a digital trust problem, according to the report. Adversaries are harvesting and storing encrypted data today on the assumption that a future quantum computer will decrypt it, a strategy known as harvest now, decrypt later. Anything with a long confidentiality tail, from health records to national archives to intellectual property, is already exposed to a machine that does not yet exist. Quantum-resistant algorithms such as ML-DSA solve the cryptographic problem, but they introduce much larger keys and signatures. Deployed through today's public key infrastructure, they would inflate or possibly break the systems behind secure connections. Legacy systems and high-latency networks would feel it most.

The report says the most significant development in Google's roadmap may be the easiest to miss. Under Domain 2, Integrity and non-repudiation, a single line reads Google Trust Services, Merkle Tree Certificates, 2028. Merkle Tree Certificates are a new kind of website domain certificate designed to keep secure connections fast in the coming era of quantum computers. Today a website proves its identity by presenting a certificate that carries several digital signatures, and the quantum-resistant versions of those signatures are so bulky they would slow down every secure connection on the internet. MTCs address this by having the certificate authority record everything it issues in a public, tamper-evident log organized as a Merkle tree. Rather than carrying heavy signatures, the website presents a short trail of digital fingerprints showing its certificate sits in that log, and the browser checks the trail against a summary of the log it already received through its normal software updates.

MTCs do not abandon X.509. They are X.509 certificates, carrying a proof where a signature used to sit, issued alongside conventional directly-signed certificates rather than replacing them. The result is a certificate that stays small, stands up to quantum computers, and is publicly verifiable by default. For the regular everyday person, the report says, we get to keep using the internet fast and uninterrupted with quantum resistance underneath.

MTCs make transparency structural. In today's web PKI, transparency is bolted onto issuance as a separate step. The CA signs a certificate, submits it to independent CT logs, and collects SCTs, each of which is a log's signed promise to publish the certificate within a fixed window. A misbehaving or compromised log can vouch for a certificate that never becomes visible to the monitors watching for misissuance. MTCs change that relationship. The CA certifies by logging, and a certificate is literally a proof that its entry appears in the CA's public issuance log, verified by the browser on every connection. If it is not in the log, it is not a certificate. Under MTC, transparency does not merely survive the post-quantum transition; it comes out stronger.

When the vendor with the dominant browser share proposes a new certificate format and a new root store to hold it, it is reasonable to ask whether the rest of the ecosystem is being consulted or simply informed. However, MTCs are not Google's alone. At the time of writing, the IETF draft's authors span Google, Apple, Cloudflare, and Geomys. Cloudflare has been involved from the outset, CAs including Sectigo have contributed to the underlying research, and Let's Encrypt publicly committed to MTCs in June 2026. The result will be an open standard any CA can implement, controlled by no single vendor. The organizations that will shape post-quantum web trust are the ones in the working group now. Root programs, CAs, and large implementers who stay outside it will inherit decisions rather than influence them. That choice is available to everyone, and the window is open.