The post-quantum cryptography (PQC) transition is progressing unevenly: encryption (key establishment) is well underway with ML-KEM hybrids already securing most web traffic, but authentication remains a harder, messier problem. NIST standardized ML-KEM and ML-DSA in 2024, and these algorithms are now in major libraries and OS distributions. However, Google's rejection of ML-DSA for public certificates in favor of Merkle Tree Certificates (MTC) is fragmenting the PKI ecosystem. MTC adds significant complexity — new CA infrastructure, rebuilt ACME, more certificate types per server, and multi-step rotation. The deeper unsolved problem is downgrade attacks on authentication: once cryptographically-relevant quantum computers (CRQCs) exist, attackers could mint fraudulent certificates using compromised CA keys, and simply deploying PQC certificates isn't enough — all non-PQC cryptography must be disabled. Deadlines have tightened from 2035 to 2029 for major vendors, and a new signaling mechanism is still needed to selectively enforce PQC-only authentication before the full transition completes.
