The post-quantum certificate gap
In 1979, a Stanford doctoral student named Ralph Merkle proposed a way to use one-time signature keys more than once. Leslie Lamport had just invented a signature scheme that year whose only flaw was its name: one-time. Each key pair could sign exactly one message, and then it was spent, which made distributing a single public key for many messages practically impossible. Merkle’s fix was a binary hash tree: plant one-time keys at every leaf, hash pairs of nodes upward until only a single root remains, and publish that root as your public key.
Verifying any signature requires only the signature itself plus a short chain of intermediate hashes connecting it back to the root. Merkle called it a hash tree. The field called it a Merkle tree. Forty-seven years later, it was about to become load-bearing infrastructure.
On September 29, 2026, Matthew Prince, CEO of Cloudflare, announced that the company would become a public certificate authority — one built specifically around a format called Merkle Tree Certificates, which Cloudflare engineers had co-authored as an IETF draft specification. To ensure its new certificates would be trusted by devices that hadn’t received a software update in years, Cloudflare agreed to acquire existing root key material from GlobalSign. Production issuance was set for Q1 2027.
The problem the announcement was solving is arithmetic. An ML-DSA signature — the post-quantum signing algorithm NIST standardized as FIPS 204 in August 2024 — is between 2,420 and 4,595 bytes depending on security level. An elliptic-curve signature is 64 bytes. A standard HTTPS connection carries at least three of these: the leaf certificate, the intermediate, and a Certificate Transparency timestamp. Three post-quantum signatures together add somewhere between seven and fourteen kilobytes to every TLS handshake in the world. Browser vendors who had shipped hybrid ML-KEM key exchange without objection looked at that number and declined to touch certificates. The final unresolved piece of the post-quantum migration sat open through all of 2025 and into 2026.
Merkle Tree Certificates change the signing model at its root. Instead of a certificate authority signing each certificate individually, the CA appends certificates to an append-only log and signs only the tree’s root — a single compact operation regardless of how many certificates the tree holds. A browser validating a site’s certificate doesn’t receive the leaf’s post-quantum signature; it receives a proof of inclusion, a lightweight hash chain connecting the certificate to a tree head it already trusts. Cloudflare tested two variants of this design against real traffic in Chrome Beta, with billions of certificates. The “landmark-relative” variant — which assumes the browser already has a recent tree head cached — delivered connections 9 percent faster than existing classical signature chains.
The elegant move is what MTCs do to the audit trail. Certificate Transparency, the logging system Chrome has required for all publicly trusted certificates since April 2018, exists to prove a certificate was issued before it was deployed — a parallel check against the CA’s own records. MTCs collapse that separation: the log is not proof of issuance, it is issuance. Cloudflare’s shorthand for the design was “don’t log what you issue, issue by logging.”
NIST has set 2029 as the outer deadline for completing the cryptographic migration. Certificates are the piece that remained. Whether Merkle Tree Certificates become the standard or a template for what follows, the underlying move — amortizing one large post-quantum signature across thousands of certificates by signing a tree root — is the same operation Merkle described in 1979 to solve an entirely different problem.
He built the structure before anyone had designed the threat.
Sources
- Help Net Security: Post-quantum website certificates from Cloudflare are scheduled for early 2027 (September 30, 2026) — Announcement date, Matthew Prince, GlobalSign deal, Q1 2027 production timeline, pending root program acceptance.
- Hardware Busters: Cloudflare Becomes a Post-Quantum Certificate Authority, Betting on Merkle Tree Certificates to Keep TLS Lean — MTC technical mechanics, 40× size problem vs. EC signatures, Chrome Beta testing, landmark-relative 9% performance result, NIST 2029 deadline.
- Wikipedia: Merkle signature scheme — Ralph Merkle’s 1979 development, relationship to Lamport one-time signatures, quantum resistance of hash-based constructions.