Google’s PQC roadmap puts traditional digital certificates under pressure

Google has advanced its post-quantum cryptography (PQC) migration timeline to 2029, six years ahead of the National Institute of Standards and Technology (NIST) and two years ahead of the NSA's requirement for national security systems. This move signals a strong commitment to security, backed by a detailed product-by-product roadmap organized around three risk domains, with milestones attached to specific services.

The most significant domain is Google's focus on cryptographic agility, enabling flexible systems to adopt new cryptographic standards with minimal engineering effort as they evolve.

Quantum risk has already become a digital trust issue, as adversaries are currently harvesting and storing encrypted data under the assumption that a future quantum computer will decrypt it. Quantum-resistant algorithms, such as ML-DSA, address this problem but introduce larger keys and signatures. When deployed using today's public key infrastructure (PKI), they can significantly increase or even break secure connections, particularly in legacy systems and high-latency networks.

A key development in Google's roadmap is the introduction of Merkle Tree Certificates (MTCs) under Domain 2, Integrity and non-repudiation. MTCs are a new type of website domain certificate designed to maintain fast secure connections in the era of quantum computers. They solve the bulky signature issue by having the certificate authority (CA) record all issued certificates in a public, tamper-evident log organized as a Merkle tree.

Instead of carrying heavy signatures, websites present a short trail of digital fingerprints to show that their certificate is in the log, and browsers check the trail against a summary of the log already received through regular software updates.

MTCs complement, rather than replace, the X.509 standard. They remain small, resistant to quantum computers, and can be publicly verified by default. This approach maintains transparency throughout the post-quantum transition, making it stronger. The development of MTCs is not exclusive to Google. The IETF draft's authors include representatives from Google, Apple, Cloudflare, and Geomys, with contributions from major CAs and Let's Encrypt committing to MTCs in June 2026.

This collaboration will result in an open standard that any CA can implement, controlled by no single vendor.

While Google's 2028 target for MTCs is subject to change, the direction appears settled. Chrome's planned Quantum-resistant Root Store will only support MTC format certificates, moving away from traditional X.509 signatures. Organizations should prepare for MTCs by conducting a complete inventory of certificates and cryptographic assets, implementing automated certificate lifecycle management to handle shorter lifetimes, and ensuring they can adopt new standards without extensive engineering programs, which is the essence of cryptographic agility that Google built into its plan.