Sometime in the last week of October 2025, the internet crossed a line that should have made headlines. For the first time, more than half of all human web traffic was protected by an encryption key that a quantum computer cannot crack.¹
There was no announcement. No keynote. No press release. Your browser just started doing it, and you never saw a thing.
Here is the part that milestone hides. The conversation got quantum-proof. The identity did not. We replaced the locks with ones a quantum computer cannot pick, and left the ID badges signed in ink it can forge. We are halfway through the most important cryptographic migration in the history of the internet, and the half we finished was the easy half.
Let me show you exactly what happened, because the details are stranger and more urgent than the headline.
The attack that does not need a quantum computer
To understand why the largest networks on earth moved this fast, you have to understand the one attack that already works today, with hardware anyone can buy.
It is called Harvest Now, Decrypt Later. The idea is simple and a little cold. An adversary records your encrypted traffic today: the banking session, the medical record, the diplomatic cable, the source code. They cannot read it. They do not try. They store it. Then they wait. On the day a cryptographically relevant quantum computer exists, they run Shor’s algorithm against the key exchange that protected that traffic, recover the session keys, and read everything they captured years earlier.
Sit with the implication. The encryption you use today has to survive a computer that does not exist yet. That is the entire problem. And it is why “wait until the threat is real” is the one strategy guaranteed to fail. By the time the quantum computer is real, the data you sent today is already sitting on someone else’s drive, waiting.
That is the clock the hyperscalers were watching. Not the day quantum breaks encryption. The day they could no longer protect data that was already being recorded.
What actually shipped
The fix is a new kind of key exchange, and it is already running underneath this very page if you are reading it in a modern browser.
When your browser opens an HTTPS connection, the first thing it and the server do is agree on a secret key, over a channel anyone can see, without ever sending the key itself. For twenty-five years that handshake leaned on elliptic curve math. That math is exactly what Shor’s algorithm dismantles.
The replacement is a hybrid. The current standard is a key exchange group with the unglamorous name X25519MLKEM768. It runs two key exchanges at once and stirs the results together: the classical elliptic curve one (X25519) and a post-quantum one (ML-KEM-768, the NIST-standardized algorithm that the world used to call Kyber). To recover the session key, an attacker has to break both. A future quantum computer breaks the classical half. Nothing on the horizon breaks the post-quantum half. So the combined secret holds.
The elegant part is that you did nothing to turn it on. TLS 1.3 negotiates this automatically. Your browser offers the hybrid group in its opening message. If the server supports it, they use it. If the server does not, they fall back to the old way, with no error and no warning. The upgrade rode in on auto-negotiation, which is why it reached half the web without a single support ticket.
How far this has gone, and how fast
The numbers are the genuinely shocking part. Pay attention to the gap between two of them.
By the week of October 28, 2025, more than half of all human-initiated web traffic to Cloudflare was using post-quantum encryption. The figure was 52 percent.¹ Eighteen months earlier it was effectively zero.
And yet, in that same report, only about 3.7 percent of public web servers actually offer post-quantum key agreement at all.²
Read those two facts together, because the contradiction is the whole story. Most of the web’s traffic is already quantum-safe, while most of the web’s servers are not. Both are true at once because a handful of giants carry most of what humans actually do online. When Google, Cloudflare, Meta, Microsoft, Amazon, and Apple flip a switch, half the internet moves. The other 96 percent of servers, the long tail of enterprise systems, embedded devices, and legacy platforms, have not moved at all.
The rest of the picture fills in fast. In April 2025, OpenSSL 3.5 shipped as a long-term-support release with ML-KEM on by default.³ The most widely used cryptographic library on earth now does this out of the box. Every major browser turned it on by default through late 2025: Chrome, Edge, Firefox, and Apple’s platforms.⁴ The major clouds and CDNs reached general availability: AWS across KMS, ACM, and Secrets Manager; Akamai on by default at the edge; Microsoft across Edge and Windows.⁵
And here is the detail that should stop you. All of this deployed before the standard was finished. X25519MLKEM768 is, as of this writing, still an Internet-Draft at the IETF, not yet a published RFC.⁶ The biggest names on the internet rolled out a brand-new cryptographic primitive at planetary scale ahead of the document that formally defines it. That is not how careful infrastructure engineering normally works. It tells you how seriously these teams take Harvest Now, Decrypt Later.
The half nobody finished
Now the turn, and it is the most important paragraph in this piece.
Everything I just described protects exactly one half of TLS. Confidentiality. The key exchange. The secret that encrypts your session so a recorder cannot read it later.
It does nothing for the other half. Authentication. The certificate that proves the server on the other end is actually your bank and not an impostor. That proof is a digital signature, and every public certificate on the web today is still signed with RSA or elliptic curve. Cloudflare said it plainly in the same report: not a single public post-quantum certificate is in use.⁷
We quantum-proofed the conversation and left the identity exactly as breakable as it was a decade ago.
If that sounds like an oversight, it is not. It is triage, and it is the correct triage. Go back to the threat model. Harvest Now, Decrypt Later is an attack on confidentiality, and it is retroactive. Traffic captured today can be decrypted in the future. That is an emergency you have to fix before the quantum computer arrives, because the damage is already accruing.
Authentication does not work that way. A signature only has to be secure at the instant it is checked. You cannot record a handshake today and forge its signature in the future, because by then the session is long over and the certificate has rotated. There is no “harvest now, forge later.” The forgery attack only becomes real once a quantum computer actually exists, and it has to happen live, in the moment.
So the industry made the rational call. Fix the part that can be attacked retroactively first. Fix the part that can only be attacked in real time second. Confidentiality was the fire. Authentication is the renovation. The fire got put out at remarkable speed. The renovation has barely started, and it is the harder job: post-quantum certificate signatures are larger, the certificate chains get heavier, and the whole change depends on browser vendors, certificate authorities, and the CA/Browser Forum moving in lockstep.
Where that leaves us
Add it up. The encrypted conversations of roughly half the human web are quantum-safe. The certificates that authenticate them are not. The other 96 percent of web servers have not moved. And classical key exchange is still offered nearly everywhere, which means the protection only holds for connections where the hybrid actually gets negotiated. Until the old algorithms are switched off entirely, a determined attacker can still push a connection back down to the classical path and harvest that.
So the work ahead is not “turn on ML-KEM.” It is three harder things. Migrate authentication to post-quantum signatures. Drag the long tail of servers off the sidelines. And eventually retire classical key exchange for good, so there is nothing left to downgrade to.
None of that, though, is the part that keeps me up at night. The part that does is the clock. Because while the internet was quietly going half-post-quantum, the machine on the other end of this threat got dramatically closer. The estimates of how big a quantum computer needs to be to break RSA have collapsed by more than an order of magnitude in six years. Governments have stopped suggesting and started mandating, with hard deadlines that are closer than most boardrooms realize. That is Part 2.
The takeaway most people miss
The good news is the one almost nobody says out loud: the technology already exists, it already works, and half the web already runs it. Post-quantum encryption is not a research project or a future roadmap item. It is the default in your browser right now.
The bad news is the half that got finished was the easy half. The conversation is safe. The identity is not. And the clock on both is shorter than it looks.
Part 2 covers how close Q-Day actually is, what the world’s governments have already put in writing, and exactly how an enterprise migrates its own systems. Subscribe and it will land in your inbox the day it publishes.
Tim McAllister is Regional Field CTO at DigiCert, leading customer-facing technical strategy for device trust, PKI, and post-quantum cryptography. He participates in NIST, SAE EVPKI, Matter, and CharIN standards bodies. Views are his own.
AI tools used (companion video)
In the spirit of the transparency this series argues for, the companion video was produced with AI-assisted tooling:
Narration voice: tts.ai (Kokoro model), “George” British male voice)
Animation and render: Remotion (programmatic React video), 1080p
Research, script, and assembly: Anthropic Claude (Claude Code, Opus 4.8)
Audio and graphics: ffmpeg, plus HTML and CSS rendered via headless Chromium
Every statistic was verified against the primary sources cited below. The analysis, claims, and final edit are the author’s own.
Sources
[1] Cloudflare, “State of the post-quantum Internet in 2025,” blog.cloudflare.com/pq-2025/, October 28, 2025. More than 50 percent (reported as 52 percent) of human-initiated HTTPS traffic to Cloudflare used post-quantum key agreement (hybrid X25519MLKEM768). Denominator: human-initiated traffic to Cloudflare, which excludes bot and API traffic, and is Cloudflare’s vantage point rather than the whole internet.
[2] Cloudflare, “State of the post-quantum Internet in 2025,” October 28, 2025. Approximately 3.7 percent of publicly reachable web origins supported post-quantum key agreement, up from roughly 0.5 percent in 2023.
[3] OpenSSL Project, “OpenSSL 3.5 Final Release,” openssl-library.org, April 8, 2025. A long-term-support release adding ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), offering X25519MLKEM768 as a default TLS key share.
[4] Chrome Platform Status (chromestatus.com/feature/5257822742249472); Mozilla Firefox release notes (132+ for TLS, 135+ for QUIC); Apple platform documentation (iOS, iPadOS, and macOS 26). All four major browser engines default-enable X25519MLKEM768 as of late 2025.
[5] AWS Security Blog, “ML-KEM post-quantum TLS now supported in AWS KMS, ACM, and Secrets Manager”; Akamai (post-quantum at the edge, default-on for eligible delivery as of January 31, 2026); Microsoft (post-quantum support across Edge and Windows cryptographic APIs, general availability November 2025).
[6] IETF, draft-ietf-tls-ecdhe-mlkem, datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/. The specification defining X25519MLKEM768 remained an Internet-Draft, not yet a published RFC, as of May 2026.
[7] Cloudflare, “State of the post-quantum Internet in 2025,” October 28, 2025: “not a single public post-quantum certificate is used.” Web authentication continues to rely on classical RSA and ECDSA signatures.