The algorithm question is solved. The ownership question isn't.

Reports

The algorithm question is solved. The ownership question isn’t.

by Simon McCorkindale September 22, 2026

Six stories broke in the space of three weeks in September 2026, and none of them, on its own, looks like big news. Read together, they mark a shift in what “post-quantum readiness” means. For two years the industry conversation has been about which algorithm to pick and when to switch it on. That question is now close to mechanical — the standards are finished, the parameter sets are named, and even the one genuine dispute left in the field (whether to run old and new crypto side by side) has five clear national answers you can simply look up and follow. What’s opening up behind it is a harder question: who actually controls the cryptography your organisation depends on, and what happens when the answer is “someone else, offshore, on their own timeline.”

The algorithm question, briefly, because it really is nearly done

The UK’s NCSC recommends two algorithms for almost everything: ML-KEM-768 to agree a shared secret, ML-DSA-65 to sign. Every parameter set on the table is strong enough for anything up to OFFICIAL-classified information — the choice among them is about bandwidth and processing cost, not safety, and the highest tier only earns its overhead where keys are unusually long-lived or protect data that has to stay secret for decades (the harvest-now-decrypt-later case NZ readers will recognise). Firmware and software signing is the one job that wants a different family entirely: SLH-DSA, LMS or XMSS, all built on plain hash functions rather than the lattice maths behind ML-KEM and ML-DSA, because a signature on firmware may need verifying by hardware nobody updates, years after it shipped.

The genuinely unsettled question — whether to run a post-quantum algorithm alongside the classical one it replaces, a “hybrid” — gets five different answers from five national authorities, and the split is instructive. France’s ANSSI makes hybrid mandatory inside its regulated scope. Germany’s BSI recommends it and stops recommending classical-only key agreement after 2031. The NCSC treats it as a deliberately temporary bridge. NIST stays neutral. The NSA tells its own national security systems not to bother, because a hybrid is overhead for no lasting benefit once a capable quantum computer actually exists — the classical half of any hybrid becomes worthless the moment that happens.

For most organisations outside those five regulatory scopes, the practical answer has already been made for you. TLS 1.3 offers X25519MLKEM768 as a configuration choice, browsers have shipped it, and Cloudflare’s own measurements have that hybrid protecting more than 65% of the human traffic it fronts as of April 2026. That’s the same hybrid sitting behind the “origin PQC” numbers in our own critical-infrastructure scan. The lesson underneath the five-agency split isn’t “pick a side” — it’s that a hybrid you build yourself is a second migration you’re volunteering for, while the hybrid your protocol already gives you costs nothing extra to inherit.

Sovereignty is now a measurable, separate thing from readiness

A paper out of Multimedia University this month proposes a Readiness–Sovereignty Capability Model, scoring 57 countries not just on whether they can adopt post-quantum algorithms but on whether they can design, build and validate their own — indigenous cryptographic capacity, as distinct from being a well-prepared customer of someone else’s. Twenty countries clear the bar for what the model calls quantum-safe capacity; fifteen are “full-stack makers,” five are research-only. Eleven more have solid general cryptographic capability but no indigenous post-quantum layer at all — able to implement, not able to originate. The correlation between a country’s general cybersecurity standing and its actual sovereign PQC capability was weak: 0.22. Being a cybersecurity-conscious nation and being a cryptography-making nation turn out to be nearly independent variables.

Switzerland is acting on exactly that distinction. WISeKey and its subsidiary SEALSQ signed a memorandum this month with the Canton of Jura to build a Swiss Post-Quantum Semiconductor and Cybersecurity Center — an indicative CHF 40–60 million over six years, built around SEALSQ’s QS7001 chip, covering design, root-of-trust injection, and secure provisioning on Swiss soil rather than importing it. The explicit framing from the Canton’s economy minister was sovereignty, not cost or convenience: the ability to “personalize, provision and protect the cryptographic roots of trust inside semiconductors” domestically. It’s a small country — smaller than New Zealand — spending real money to avoid being a permanent taker of someone else’s cryptographic supply chain.

Meanwhile QNu Labs launched QShield 2.0 in Bengaluru, the platform behind what it calls a National Cryptographic Assessment & Assurance Framework: five modules covering discovery, risk-scoring and continuous assurance, explicitly pitched at the same gap this paragraph keeps returning to — organisations, and by extension nations, that cannot currently produce an accurate account of their own cryptography. It’s a vendor launch, so treat the marketing claims as marketing, but the shape of the product is worth noting on its own terms: “discover, assess, assure” as a continuous cycle rather than a one-off audit is precisely the operating model a maintained baseline (rather than a snapshot) requires — which is the same argument behind why we re-scan.

The ecosystem is moving into places you wouldn’t expect

Lattice-based cryptography’s credibility problem — that it’s newer and less battle-tested than the classical alternatives it replaces — is eroding fastest in places with nothing to do with government mandates. A16z Crypto rebuilt its Jolt zero-knowledge proof system, used to prove blockchain computations ran correctly without re-running them, on a lattice-based commitment scheme called Akita instead of the elliptic-curve one it used before. The result: proofs two to three times faster, under 100 KB, and — not the headline, but the actual reason it’s relevant here — built on the same Module-SIS/Module-LWE family of problems underpinning ML-KEM and ML-DSA. Lattice cryptography is no longer only the thing NIST standardised for TLS handshakes; it’s becoming infrastructure that venture-funded crypto engineering teams choose on performance grounds alone.

And a reminder that the classical side of this equation keeps eroding on its own schedule, quantum computers aside. Anthropic’s Steve Weis reported factoring RSA-896 this month, using Claude to help adapt the CADO-NFS sieving toolchain for GPU clusters — around 2,048 GPUs, ten days, roughly 30 GPU-years of aggregate compute. Weis is careful about what this does and doesn’t show: it’s not an algorithmic breakthrough, and RSA-2048 — what’s actually deployed almost everywhere — isn’t threatened by it. But he argues RSA-1024 is now within reach of anyone with data-centre-scale GPU budget, no quantum computer required. Pop the champagne if you like — your RSA-2048 traffic is unaffected — but the margin between “theoretically factorable” and “practically factorable” keeps narrowing on classical hardware alone, which is exactly the kind of quiet erosion that harvest-now-decrypt-later risk assessments exist to price in.

The NZ read

None of the 57 actors scored in the sovereignty paper are named in what’s public so far, and we’re not going to guess where New Zealand would land. But the shape of the question answers itself. New Zealand doesn’t design lattice-based algorithms, doesn’t fabricate secure semiconductors, and isn’t going to build a Swiss-style chip centre — that was never realistically on the table for a country our size, any more than it was for most of the 57. The RSCM framework’s real value for us isn’t a ranking; it’s the vocabulary. It separates “we can turn PQC on” from “we control the supply chain that lets us turn it on,” and New Zealand sits unambiguously in the first category, not the second.

That’s not a criticism — it’s the honest starting point, and it’s the same starting point our own recurring scan keeps landing on. New Zealand remains the only Five Eyes nation with no formal PQC migration deadline. What movement we do see in the origin honour roll is driven overwhelmingly by decisions made offshore: Google and Cloudflare’s 2029 target, browser vendors defaulting hybrid key agreement on, and — as the June re-scan showed in granular detail — a CDN operator’s own infrastructure choices revealing or removing PQC at eleven hospitals and one rail operator without those entities touching their own configuration. Fastly still sits at 0% PQC at the edge, covering four nationally significant entities, and that isn’t a decision any of those four organisations gets to make unilaterally; it’s a vendor roadmap decision made somewhere else.

Which is exactly why the hybrid-versus-build-your-own logic in the algorithm section above matters more here than in a country with its own regulatory teeth. When ANSSI or the NSA hands down a binding answer, a French or American operator inherits a decision made by an authority they can point to. New Zealand critical infrastructure operators inherit decisions made by CDN vendors and browser makers with no NZ-specific obligation at all — which is a sovereignty gap in miniature, playing out one contract renewal at a time. The DPMC’s critical infrastructure consultation, which we submitted on in April, still makes no substantive mention of cryptography, and the promised Critical Infrastructure Bill has no public enforcement mechanism for NZISM 2.4 attached to it yet. Until one of those changes, “readiness” here will keep meaning “however ready our vendors decided to make us” — which is precisely the distinction this month’s research gave a name to.

Kaysec is the post-quantum security practice of Spinsphere, a New Zealand-based quantum technology company. We help NZ organisations with cryptographic inventory, HNDL risk assessment, TLS configuration auditing, and PQC migration planning. Get in touch.

If it lives long, protect it.

References

Rehman, M. U. (2026, September 21). QNu Labs launches QShield 2.0 for cryptographic discovery and quantum readiness. The Quantum Insider.
Swayne, M. (2026, September 9). a16z Crypto rebuilds Jolt proof system with post-quantum security and faster performance. The Quantum Insider.
Futurist. (2026, September 1). Choosing post-quantum algorithms, and whether to run them alongside the old ones. Quantum Zeitgeist, drawing on NCSC, ANSSI, BSI, NIST and NSA guidance documents.
Rohail T., M. (2026, September 21). QNu Labs maps national cryptographic sovereignty capabilities. Quantum Zeitgeist, reporting on Bouke, M. A., A Global Readiness and Sovereignty Capability Model for Post-Quantum Cryptography Migration, arXiv:2609.18477.
Quantum Computing Technology. (2026, September 21). RSA-896 has been factored. Steve Weis reports factoring RSA-896 using Claude. Quantum Zeitgeist.
Delaney, I. (2026, September 21). SEALSQ, WISeKey and Jura Canton plan Swiss quantum security center. Quantum Zeitgeist.