The week-over-week companion to Overview - Post-Quantum Cryptography and PQC Deployment and Libraries Tracker. This note covers developments since the June 20 update. The dominant story is the Trump PQC Executive Order (June 23) imposing hard federal deadlines (2030/2031), the liboqs 0.16.0-rc1 release (June 24) with SLH-DSA standardization and SPHINCS+ removal, and the OMB M-26-15 Migration Playbook. Cloudflare accelerates its full-PQ (incl. authentication) target to 2029. Freedom-tech takeaway: policy is now forcing the migration that implementers have been warning about; crypto-agility, inventory of long-lived keys, and hybrid defaults are no longer optional for any sovereign or decentralized system.
TL;DR — This Week
- Trump PQC Executive Order (June 23, 2026) — Directs federal agencies to appoint PQC transition leads within 30 days. Mandates PQ key migration for “high value assets” and “high impact systems” by Dec 31, 2030; PQ digital signatures by end of 2031. NIST pilot project due by end 2027. Procurement rules for contractors by 2030. Accelerates previous 2035 timelines. Companion quantum innovation EO also signed.
- OMB M-26-15 Federal PQC Migration Playbook (June 25, 2026) — Official guidance playbook released two days after the EO.
- liboqs 0.16.0-rc1 (June 24, 2026) — Removes SPHINCS+ (replaced by SLH-DSA per FIPS 205). Stronger mldsa-native integration. Continues the standardization cleanup.
- Cloudflare 2029 Full Post-Quantum Target — Updated roadmap prioritizes post-quantum authentication (certificates, signatures) alongside encryption. Cites recent neutral-atom and algorithm advances pulling Q-Day estimates forward.
- NIST Additional Signatures Round 3 — 9 candidates (FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV) continue evaluation (~2-year round).
- Conferences & Momentum — ETSI/IQC QSC 2026 (Ottawa, June 16-18); GSA 2026 PQC Summit scheduled for Sept 16.
The freedom-tech takeaway: Washington has now set an enforceable clock. Decentralized projects must treat 2030 as a hard migration horizon for any system with long-lived keys or authentication (Nostr, Bitcoin, mesh networks, confidential compute attestation). Hybrid KEMs + crypto-agility remain the pragmatic path.
The Week in Detail
1. Trump PQC Executive Order — “Securing the Nation Against Advanced Cryptographic Attacks” (June 23)
Signed Monday June 23. Key provisions: - Agencies identify lead PQC officials within 30 days. - High-value / high-impact systems: PQ keys by Dec 31, 2030; PQ signatures by Dec 31, 2031. - NIST to run migration pilot (complete by end 2027). - OMB issues detailed guidance within 90 days (M-26-15 playbook already out). - Federal Acquisition Regulatory Council to impose PQC requirements on contractors by 2030. - Emphasis on crypto-agility, supply-chain, and shared procurement.
Industry reaction (Cloudflare, QuSecure, Keeper Security, etc.): “Lights a fire,” “makes NIST work enforceable,” “quantum readiness is no longer a future problem.” Funding questions remain (~$7B+ estimated previously).
Relevance to Ungovernable.tech: Any project relying on classical signatures or KEMs for identity, software distribution, or long-term sealed data now has a concrete external deadline. Inventory long-lived keys (root CAs, code-signing, Nostr identity keys, Bitcoin multisig) immediately.
2. liboqs 0.16.0-rc1 (June 24)
- SPHINCS+ removed; fully replaced by SLH-DSA (FIPS 205).
- Continued mldsa-native and mlkem-native integration improvements.
- Part of the broader cleanup aligning with finalized NIST standards.
Projects using liboqs (OpenSSL oqs-provider, OpenSSH, language wrappers) should plan the 0.16 upgrade and drop legacy SPHINCS+ paths.
3. Cloudflare Roadmap Update (targeting 2029 full PQ)
Cloudflare now publicly targets 2029 for complete post-quantum security, including authentication (not just encryption). - Current state: >65% of human traffic already PQ-encrypted. - Drivers: Recent neutral-atom hardware progress + improved error-correction + faster Shor variants on P-256/RSA. - Priority shift: Authentication (long-lived keys) is now the urgent frontier because a single forged root or code-signing key is catastrophic once Q-Day arrives.
Recommendation from Cloudflare (and echoed here): - Inventory all quantum-vulnerable long-lived keys. - Deploy hybrid + PQ where possible. - Plan for disabling classical fallbacks + secret rotation. - PQ HSTS / Certificate Transparency for downgrade protection.
4. Other Notable Items
- NIST IR 8610 / Additional Signatures: Round 3 ongoing (9 candidates).
- ETSI/IQC Conference (mid-June): Technical track on implementation realities.
- GSA PQC Summit (Sept 16, 2026): Federal implementation focus.
- No major new implementation CVEs reported this week (post-Bernstein June 1 paper and prior liboqs fixes).
Evidence at a Glance
| Item | Date | Source | Status / Impact |
|---|---|---|---|
| Trump PQC EO | 2026-06-23 | White House | Hard 2030/2031 deadlines for federal systems |
| liboqs 0.16.0-rc1 | 2026-06-24 | GitHub | SLH-DSA only; SPHINCS+ gone |
| OMB M-26-15 Playbook | 2026-06-25 | OMB | Migration guidance released |
| Cloudflare 2029 target | 2026-04-07 (updated context) | Cloudflare Blog | Full PQ incl. auth by 2029 |
| NIST Round 3 Signatures | May 2026 onward | NIST CSRC | 9 candidates, ~2 years |
Action Items for the Vault / Freedom-Tech Projects
- Update Overview - Post-Quantum Cryptography “updated” date and add EO section.
- Track contractor/procurement implications in PQC Deployment and Libraries Tracker.
- Add entries for any new hybrid signature schemes or migration tools as they appear.
- Cross-link to Bitcoin PQ Migration and identity notes given new deadlines on long-lived keys.
Next Saturday update expected June 2026 week 27 developments (NIST pilot kickoff, early agency responses, any 0.16.0 final release).
Related files: Overview - Post-Quantum Cryptography, PQC Deployment and Libraries Tracker, Hybrid KEM Migration, Bitcoin PQ Migration, ML-DSA, ML-KEM, SLH-DSA
Research compiled from primary sources (White House, NIST CSRC, GitHub releases, Cloudflare blog) — June 27, 2026.