[TLS] Re: Complaint to ADs and IESG regarding TLS WG chairs falsely claiming WG consensus to issue an RFC for draft-ietf-tls-mldsa

[Martin Thomson <[e-mail]>]

On Thu, May 28, 2026, at 08:19, Nico Williams wrote:
> I think perhaps I am making too much of the problem in the signature
> case.  Just be ready to switch to PQ PKIs and do it when a CRQC appears,
> and otherwise take your time switching.  The biggest problem here lies
> in agile trust root management <--- this is hard to do.

That's just it.  Some people are rightly concerned that the deployment phase of the switch is slow.  That leaves some risk of exposure at the point that a CRQC is developed, as we struggle with rollout of a response.

On the other hand, we know how to revoke trust anchors in a hurry.  On that basis, it might be reasonable to say that some risk of compromise from a classical computer is justified if we can be in a position to move quickly when the rumors of there being a CRQC hit the tipping point.

In light of that, a hybrid scheme as a means of mitigating the near-term risks of rollout, even if the classical part of the hybrid only ends up as baggage once the CRQC exists.