Ml-Kem

I gave this talk at PA TechCon 2026 in Harrisburg on August 13. The audience was Pennsylvania state and local government IT leaders — CIOs, CISOs, procurement officers, and the county IT directors who keep the lights on with two-person teams. The premise fits in one sentence: Pennsylvania’s data has a shelf life measured in decades, and the encryption protecting it has a shelf life measured in years. Nobody has done the subtraction. ...

Post-quantum cryptography is no longer a standards exercise. ML-KEM key exchange is the default in every major browser and in OpenSSH. RHEL 10 ships with post-quantum TLS and SSH enabled out of the box. DigiCert is issuing ML-DSA certificates today. But “available” and “deployed” are not the same thing. Key exchange is largely solved. Authentication — the part where certificates, signatures, and trust chains live — is not. The gap between what the standards define and what production systems can actually verify is where most of the engineering work remains. ...