The defining asymmetry of PQC deployment in 2026: When a Chrome user loads a website over X25519MLKEM768 — the hybrid TLS key exchange that is now the default in Chrome, Firefox, Edge, and Safari — the symmetric session key protecting that connection is post-quantum secure. But the server certificate that authenticated the handshake is still signed with classical ECDSA P-256 or RSA-2048. No ML-DSA roots exist in the Mozilla, Apple, Microsoft, or Chrome trust stores. The CA/Browser Forum's Server Certificate Working Group has a PQC ballot tracker but no merged baseline requirement permitting ML-DSA in publicly trusted certificates as of this edition. This means the connection is protected against a quantum adversary eavesdropping on the key exchange, but a sufficiently capable quantum adversary who can forge classical signatures could still impersonate a server to initiate an authenticated connection. Understanding this asymmetry is important for accurately characterizing your organization's PQC posture in 2026.

Certificate trust stores — the remaining gap: The IETF draft-ietf-tls-mldsa was in working group last call as of May 2026. No major browser negotiates ML-DSA for server certificate by default. No public CA has issued ML-DSA root certificates chaining into any major trust store. The industry's PQC migration for session keys is largely complete at the CDN/browser layer; the migration for certificates (authentication) is still in early design stages at the standards and trust-store level.

The gap in plain terms: Breaking RSA-2048 via Shor's algorithm requires approximately 4,000 error-corrected logical qubits running deep circuits. The largest demonstrated logical qubit count as of early 2026 is 96 (QuEra Computing, January 2026). The gap is not one of physics understanding — it is engineering scale. Multiple organizations have now demonstrated the key property needed for scaling (exponential error suppression as code distance increases, sometimes called "below-threshold" error correction), meaning the path to a cryptographically relevant quantum computer is now an engineering problem rather than a fundamental science problem. That distinction matters for timeline assessments.

Timeline context (what independent analysts say): Global Risk Institute (May 2026) assessed approximately 17–22% probability of a cryptographically relevant quantum computer existing by 2031. Expert consensus across non-vendor sources places a CRQC in the mid-2030s to mid-2040s range. IBM's roadmap and PsiQuantum's photonic architecture plans represent the most specific public timelines from major players — both point to the early-to-mid 2030s for fault-tolerant systems capable of running Shor's algorithm at meaningful scale. The migration urgency comes from HNDL (data being captured now for future decryption) and procurement lead times, not from the imminent arrival of a CRQC.

A weekly maturity-signal dashboard tracking eight indicators of how post-quantum cryptography is progressing from research topic to operational reality. All items must connect specifically to the cryptographic/security implication of quantum computing — general quantum computing news that doesn't affect when classical cryptography breaks or how ready organizations are for that event is excluded. First run establishes the baseline signal reading for each indicator.

Signal states: Active = specific qualifying event confirmed this week · Moderate = ongoing background activity, no new discrete event · Quiet = no qualifying activity found. An explicit "no meaningful signal this week" is more informative than padding.