Post-Quantum Encryption Is Arriving for Free. Canada's Roadmap Asks for the Part That Is Not

The cheapest part of the post-quantum migration is already happening on its own. Chrome's team reported in September 2024 that hybrid post-quantum key agreement was on for all Chrome desktop clients, and that Chrome 131 would move it to the NIST standard, ML-KEM (Adrian et al., 2024). Firefox 132, released 29 October 2024, added the same hybrid mechanism for TLS 1.3 (Mozilla, 2024). Mozilla's administrator guide states that "Firefox offers hybrid X25519 + ML-KEM-768 key agreement by default" (Mozilla, n.d.). OpenSSL 3.5.0, released 8 April 2025, changed its default TLS key shares "to offer X25519MLKEM768 and and X25519" (OpenSSL Project, 2025). Apple states that in iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26, "TLS-protected connections will automatically advertise support for hybrid, quantum-secure key exchange in TLS 1.3" (Apple, 2026).

None of that required a purchase order. So a fair question follows: if post-quantum is built in and free, why buy anything, or plan anything? Half of that question is right. You should not buy a separate product to get post-quantum key agreement in a browser or a current TLS library. The other half is wrong, and the Canadian Centre for Cyber Security says why in one sentence.

I hold the CISSP and I have spent 25+ years in technology and security, including Government of Canada cloud security assessments. This piece is for the security or IT leader who has heard it is free and has to decide what is still on their desk.

What arrives for free, and what it protects

Public-key cryptography does two jobs in a secure connection. Key establishment sets up the secret key; signatures and certificates prove who is on the other end. NIST's transition report treats them as separate transitions, and says network protocols may move authentication "at a different time" from key establishment (Moody et al., 2026, p. 9).

Key establishment is the part arriving free. It matters because of harvest now, decrypt later: an adversary records encrypted traffic today and decrypts it once a large enough quantum computer exists. The US National Institute of Standards and Technology (NIST) calls this threat model "one of the main reasons why the transition to post-quantum cryptography is urgent" (Moody et al., 2026, p. 1). Default-on hybrid key agreement in browsers, operating systems and TLS libraries closes that gap for connections where both ends are current.

Google's Chrome team described what it shipped as a hybrid: the key exchange "used both the pre-quantum X25519 algorithm, and the new post-quantum algorithm" (Adrian et al., 2024). Hybrid is the right engineering choice. It also means the classical algorithm is still there. Apple's guidance to network administrators is explicit about the fallback: servers "can select X25519MLKEM768 if they support it, or use another group advertised in the ClientHello message" (Apple, 2026).

The sentence in the Canadian roadmap that changes the question

The Canadian Centre for Cyber Security published Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001), effective 23 June 2025. It sets four dated deliverables for federal departments and agencies (Canadian Centre for Cyber Security, 2025):

ITSM.40.001 milestones for federal departments and agencies

1. Apr 2026

   Initial departmental PQC migration plan

2. Apr 2026 →

   Annual progress report, every year after

3. End of 2031

   High-priority systems migrated

4. End of 2035

   Remaining systems migrated

Then comes the sentence that matters. Completing a migration "implies that quantum-vulnerable algorithms are disabled, isolated or tunnelled. That is, rather than just supporting PQC, the quantum risk has been mitigated" (Canadian Centre for Cyber Security, 2025, section 4).

Supporting post-quantum is what the free upgrade gives you. Disabled, isolated or tunnelled is what the roadmap counts. The roadmap also describes the usual order: a system's first stage "may be to support the use of PQC, followed by a second stage to disable the vulnerable, legacy cryptography" (Canadian Centre for Cyber Security, 2025, section 3.3). The browsers and libraries have done the first stage for you. The second is yours.

Where the free upgrade stops

ITSM.40.001 lists where to look, and almost none of it is a browser. Its identification phase names network services, operating systems, applications, code development pipelines, and physical assets from server racks and laptops to printers, voice over Internet Protocol telephony, hardware security modules, smart cards and hardware tokens, whether hosted on-premises, on contracted platforms, with a cloud provider or in an employee's hands (Canadian Centre for Cyber Security, 2025, section 3.2).

Some of that will not have an upgrade to install. The roadmap warns that "support for PQC may not be currently available in some product categories" (section 3.1.4), and that some legacy systems cannot move to post-quantum cryptography "without a full system replacement", leaving isolation or tunnelling as the way to meet the milestone (section 3.3).

Signatures are the second, slower transition. NIST says that while signatures are not exposed to harvest-now attacks, moving them "is also urgent due to the longer duration and greater complexity of the transition process and the need for a greater number of parties to coordinate" (Moody et al., 2026, p. 8). Public key infrastructure components "must be updated to issue, distribute, and manage certificates that use PQC algorithms" (Moody et al., 2026, p. 6). Code signing is the hard case: where a device cannot update the code that checks signatures after manufacture, NIST says it should be designed to require quantum-resistant signatures from the start (Moody et al., 2026, p. 8). Those keys sit in your certificate authority and your build pipeline, not in a browser.

The US just tightened its dates, and Canadian suppliers sell into them

On 27 October 2026 NIST finalized Transition to Post-Quantum Cryptography Standards (NIST IR 8547). NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it under its standards after 2035 (Moody et al., 2026, p. 13). Under Executive Order 14412 and Office of Management and Budget Memorandum M-26-15, US federal high-value assets and high-impact systems must adopt post-quantum cryptography for key establishment by 31 December 2030 and for digital signatures by 31 December 2031 (Moody et al., 2026, p. 13). NIST's announcement states the same 2030 and 2031 dates (National Institute of Standards and Technology, 2026).

A Canadian company that sells software or services to a US federal agency inherits those dates through its customer. One that sells to a Canadian department meets the Canadian dates through procurement: ITSM.40.001 tells departments to put post-quantum requirements into new contracts, and the Cyber Centre has recommended contract clauses for systems with cryptographic modules (Canadian Centre for Cyber Security, 2025, section 3.1.4).

How to decide what goes first

The roadmap tells departments to prioritize systems "susceptible to a HNDL threat", along with information lifespan, crypto-agility and impact of compromise (Canadian Centre for Cyber Security, 2025, section 3.2). Michele Mosca of the University of Waterloo framed the same question as three quantities: "the security shelf life of the information assets, the migration time to systems designed to resist quantum attacks, and the time remaining before quantum computers break the security" (Mosca, 2018). NIST's report uses the same logic: organizations must start "before X + Y exceeds the expected time Z" for a cryptanalytically relevant quantum computer to be built (Moody et al., 2026, p. 8). If a system's shelf life plus its migration time already exceeds that horizon, the system is late.

Apply it with the roadmap's own inventory fields: for each system, the components that use cryptography, vendor and product version, current configuration, hosting platform, dependencies, service contracts and expiry dates, expected refresh year and a named point of contact (Canadian Centre for Cyber Security, 2025, section 3.2). The roadmap also says not to be overwhelmed: start with an initial, incomplete inventory and improve it.

NIST's algorithm standards are final, so the destination is not in doubt: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures, released 13 August 2024 (National Institute of Standards and Technology, 2024).

What would change this verdict: if your estate were entirely browser-facing web services on current TLS libraries, with no virtual private networks, no on-premises appliances, no code signing and no data that must stay secret beyond 2035, the free upgrade would cover most of your exposure. I have not yet seen that estate.

Where Sagentix fits, and where it does not

Sagentix Cyber & AI builds the cryptographic inventory, the crypto-agility assessment and a migration roadmap anchored to ITSM.40.001 and the NIST standards. It does not sell cryptographic products, it does not resell any vendor's services, and the assessment of your systems stays with an independent party. The research library behind the work runs to 1,464 catalogued artifacts, and every deliverable passes an 19-check quality gate. See how the post-quantum migration work is structured.

Three paths from here

Do it yourself this quarter. Take the roadmap's inventory fields as columns and your ten most important systems as rows. Mark each system that carries data that must stay secret past 2035. Those rows are your high-priority list.

Use your vendors' roadmaps. Send the two-question letter above to every vendor in the inventory. Record the answer and the date. A blank answer is a finding.

Bring in help when the plan must survive an outside reader, such as a federal customer, a US prime contractor or an auditor. Ask any adviser you evaluate whether they also sell the cryptographic product they are recommending.

References

• Adrian, D., Benjamin, D., Beck, B., & O'Brien, D. (2024, September 13). A new path for Kyber on the web. Google Security Blog.
• Apple. (2026). Prepare your network for quantum-secure encryption in TLS. Apple Support. Published June 18, 2026.
• Canadian Centre for Cyber Security. (2025). Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001). Effective June 23, 2025.
• Moody, D., Perlner, R., Regenscheid, A., Robinson, A., & Cooper, D. (2026). Transition to post-quantum cryptography standards (NIST IR 8547). National Institute of Standards and Technology.
• Mosca, M. (2018). Cybersecurity in an era with quantum computers: Will we be ready? IEEE Security & Privacy, 16(5), 38–41. https://doi.org/10.1109/MSP.2018.3761723
• Mozilla. (2024, October 29). Firefox 132.0 release notes.
• Mozilla. (n.d.). PostQuantumKeyAgreementEnabled. Firefox administrator reference. Retrieved October 31, 2026.
• National Institute of Standards and Technology. (2024, August 13). NIST releases first 3 finalized post-quantum encryption standards.
• National Institute of Standards and Technology. (2026, October 27). NIST report provides guidelines for transition to post-quantum cryptography standards.
• OpenSSL Project. (2025). OpenSSL 3.5 series release notes. OpenSSL 3.5.0, April 8, 2025.