.png)
Most talk about quantum risk is about stolen secrets. For governments that issue records, the harder problem is forged ones. A large quantum computer will make today's digital signatures reproducible, and the only remedy is to re-sign archives with post-quantum algorithms before that happens. For a ministry, being quantum ready comes down to who controls the keys.
Quantum won't break your future. It will break your past. We put that line on the cover of our report because it is the part of the problem we see procurement teams miss most often.
Take a title deed a land registry issues this year. The family who receives it will expect it to settle a boundary dispute in 2050, and whether it can depends on the assumption, made at signing, that nobody but the registry could have produced that signature.
That assumption rests on RSA and elliptic curves. Peter Shor showed in 1994 that a large enough quantum computer could solve the maths behind both quickly, and NIST's post-quantum standards exist because of it. NIST's draft transition plan proposes deprecating the weaker settings of these algorithms after 2030 and disallowing them entirely after 2035. The deed has to stay valid for decades after both dates.
How quantum computers break digital signatures
A working quantum computer breaks two things. The first, confidentiality, is well understood. Under harvest now, decrypt later, encrypted traffic is recorded today and opened once the computer exists, so a tax filing sent this morning is exposed from the moment it leaves, even if nobody can read it yet.
The second is authenticity. A digital signature is evidence that a document came from a particular authority and has not been altered since. Once the maths behind it can be solved, anyone with the computer can produce a valid signature in the registry's name.
Old signatures do not become readable. They become reproducible. Some in the industry call this trust now, forge later. A court asked to rely on a title signed in 2026 would have no cryptographic way to tell the original from a copy made in 2040, and court orders, birth certificates and software updates signed this year carry the same risk.
Washington has put the two risks on separate clocks. Post-quantum key exchange comes first and signatures a year later, as the dates below show.
Why archives must be re-signed before 2035
There is a fix, with a deadline built into it. An institution re-signs its archive with a post-quantum algorithm such as ML-DSA or SLH-DSA, both standardised by NIST in August 2024, while the original signatures can still be trusted. Done in time, this gives an unbroken chain of evidence from the day of signing to today.
Done too late, the new signature shows only that someone had the record on the day it was re-signed. It says nothing a court can rely on about what the record said before.
Michele Mosca, of the University of Waterloo's Institute for Quantum Computing, framed the timing as a sum. Add how long information must stay protected to how long migration takes. If the total exceeds the time until a capable quantum computer exists, you are already late.
Estimates of that last number differ by decades, and for a land title the disagreement barely matters. A record that must hold for fifty years is exposed unless the computer is more than fifty years away, plus however long the migration takes. We would not bet a land registry on that.
To re-sign on its own timetable, a ministry has to be able to pick the algorithm and reach the signing keys. In many government deployments we see, the vendor controls both, and the timetable comes with them.
Crypto-agility decides who owns the record
Crypto-agility means a system can replace its cryptographic algorithms through configuration, without rebuilding the platform. The algorithm is chosen in one place, behind an interface, and the signing keys sit in hardware the owner controls.
The opposite is common. The algorithm is hard-coded in the vendor's software, the keys live in infrastructure the vendor runs, and re-signing can only happen as a vendor project. At that point the ministry does not own its records. It rents them.
A ministry that waits for its supplier's post-quantum upgrade takes whatever price and date it is offered. Every record signed in the meantime uses algorithms already scheduled for retirement, and if the contract ends or the supplier leaves the market, the upgrade path goes with it.
The quick fix does not close the gap either. A post-quantum layer placed in front of a classical system protects data in transit, which deals with harvest now. The signatures underneath, and the records they sealed, are as exposed as they were before.
Built in from the start, crypto-agility costs more at procurement. When NIST revises its list, the ministry changes a setting, runs old and new algorithms side by side during the transition, and re-signs its archive with keys it holds. That is also how we think about handover. Handing over a system should include the ability to keep it trustworthy.
The post-quantum deadlines from 2030 to 2035
Nobody knows when a large enough quantum computer will arrive. Governments have stopped waiting to find out and put dates on the cryptography instead.
In the United States, Executive Order 14412 (June 2026) requires federal high-value systems to use post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031. [EDITOR: align with the order text.] NIST's draft plan reaches further, deprecating the weaker RSA and elliptic-curve settings after 2030 and disallowing all of them after 2035.
The European Union's Coordinated Implementation Roadmap asks member states to begin national transitions by the end of 2026, move high-risk systems by 2030, and cover as much as feasible by 2035.
A national registry or identity platform procured in 2026 will typically run for ten to fifteen years, so it will still be in service on every one of these dates. The cryptographic terms in this year's contract decide whether the transition later becomes a configuration change or a renegotiation.
Why this lands harder in Africa
Many African land and civil registries are being digitised now. For a lot of these records, the first digital signature they ever carry will be made this decade, on cryptography that is already scheduled for retirement.
Mobile money adds a second exposure. Across much of the continent it is how people get paid and pay their bills, and every transaction is a signed, encrypted message.
The research money, meanwhile, is elsewhere. African quantum investment was 10.7 million dollars in 2025, against 245 billion globally, according to the UN Economic Commission for Africa's Economic Report on Africa 2026. Most African governments will buy their post-quantum stack rather than build it. What matters is whether they buy one they can control.
Four questions to ask any vendor
We put four questions to every supplier, ourselves included. Who holds the signing keys? If NIST changes its list, does anything change on our side beyond configuration? Can we re-sign our own archive without you, and how long would it take? And if you leave, what leaves with you?
Each deserves a one-line answer, and a supplier who needs a paragraph for any of them has not done the work yet.
What any ministry can start this quarter
Two things can start now, with or without us, and neither needs a new supplier.
Inventory. List what is signed, what is stored, and how long each must stay valid. Most registries have never done this. It takes weeks, not years.
Sign new records crypto-agile. From the next record onward, sign with an algorithm chosen behind an interface, with keys in hardware the state controls. Old records can be re-signed in batches. New ones should not add to the pile.
The deed a registry signs this year will outlive the algorithm that signed it. What the ministry decides now is whether it will be able to re-sign that deed itself when the time comes.
Records outlive algorithms.