Post-Quantum Saturday — July 04 2026 Weekly Update

TL;DR — This Week

• Microsoft PQC Acceleration (early July 2026): Expanded roadmap targeting SFI (Secure Future Initiative) with explicit PQC for TLS 1.3, crypto-agility frameworks, and trust chain modernization. Signals enterprise readiness moving from planning to execution.
• NIST PIV Credential Integration: Working drafts published for adding ML-DSA (signatures) and ML-KEM (key establishment) support to Personal Identity Verification (PIV) cards — the first concrete federal hardware token migration.
• liboqs 0.16.0-rc1 stabilization: Ongoing community testing; focus on SLH-DSA performance and hybrid modes. oqs-provider and language bindings updating in lockstep.
• OMB M-26-15 Implementation Momentum: Agencies beginning 120-day migration plan submissions; first DoD and civilian pilots announced.
• G7 and International Alignment: Financial sector roadmap discussions accelerating post-EO momentum; EU and UK mirroring US timelines.
• Conferences: PQCrypto 2026 (April retrospective) and upcoming GSA/ETSI events driving standardization of additional signatures (Round 3 candidates: SQIsign, MAYO, etc.).

Freedom-tech takeaway: The policy hammer has landed. Any Ungovernable project (Nostr relays, Bitcoin wallets, mesh identity, confidential compute attestation) with long-lived classical keys must now prioritize inventory + hybrid migration planning. Use liboqs + oqs-provider as the reference implementation; treat 2030 as the hard external deadline even for non-federal systems.

The Week in Detail

1. Microsoft Accelerates PQC Roadmap (July 2026)

Microsoft updated its Secure Future Initiative to explicitly include post-quantum cryptography. Focus areas: - TLS 1.3 hybrid KEMs (X25519 + ML-KEM-768) in Azure and Microsoft 365 edge. - Crypto-agility libraries and tooling for internal services. - Trust chain modernization (code signing, attestation). - Emphasis on “PQ-ready” supply chain for customers.

This follows Google’s 2029 target and Cloudflare’s full-PQ authentication push. Enterprise tooling (SDKs, monitoring) is now shipping, lowering the barrier for smaller projects.

Relevance: Decentralized apps can adopt Microsoft’s open patterns or liboqs integrations without reinventing migration tooling.

2. NIST Begins Wiring PQC into PIV Credentials

NIST published initial working drafts integrating: - ML-DSA for digital signatures on PIV cards. - ML-KEM for key establishment in authentication flows.

This is the first standardized hardware token transition path. Expect commercial PIV vendors (HID, Gemalto, etc.) to follow with firmware updates in 2026-2027.

Relevance to Ungovernable.tech: Hardware-backed identity (YubiKey-style or custom secure elements) for pseudonymous systems can start planning PQ attestation keys. Long-term sealed data or root-of-trust artifacts benefit from early hybrid designs.

3. liboqs Ecosystem & Standardization Cleanup

• 0.16.0-rc1 (June 24) testing continues; SPHINCS+ fully deprecated in favor of SLH-DSA.
• oqs-provider updates syncing with OpenSSL 3.5+ native PQC expectations.
• Language bindings (Rust, Go, Python) seeing performance improvements and ACVP test coverage.
• New: Better support for hybrid KEM combinations and constant-time guarantees post-KyberSlash lessons.

Primary source: https://github.com/open-quantum-safe/liboqs (releases page)

4. Policy & International Developments

• OMB M-26-15 Playbook: Agencies racing to deliver 120-day plans. Prioritization matrix focuses on HVAs and high-impact systems first.
• DoD PQC Strategy: Companion document released alongside the EO, emphasizing supply-chain and classified system timelines.
• G7 Financial Sector: Roadmap discussions emphasize 2030-2035 window for banks and payment systems.
• EU/UK Alignment: Similar accelerated timelines emerging.

Relevance: Even purely decentralized projects will eventually interface with regulated entities (exchanges, cloud providers, hardware vendors). Adopting NIST PQC standards now ensures interoperability and future-proofs against “harvest now, decrypt later” adversaries.

Evidence at a Glance