Cloudflare plans to become a public certificate authority and start production issuance of post-quantum Merkle Tree Certificates in the first quarter of 2027. Teams planning a post-quantum migration now have an issuer-side date to test web PKI against.
Perspective Coverage
4 publishers
- Builder
- Builder 45%
- Operator
- Operator 45%
- Investor
- Investor 10%
Reality
- Evidence50
- Adoption8
- Hype gap+30
- Incentives
- Insufficient
- Confidence60
Microsoft researcher Jiapeng Li's Limbo benchmark found AI agents duplicated side-effecting writes in 56% and 74% of in-flight and double-delivery episodes. Offering idempotency keys cut duplicates from 28% to 4%, so tools that move money or send mail should require them.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives25
- Confidence40
Cloudflare will sell an Oblivious HTTP gateway as a paid zone add-on from this fall, with a closed beta open now. It handles the decrypting half of a protocol built for two operators, and Cloudflare pitches it on lower latency than a self-run gateway.
Reality
- Evidence35
- Adoption15
- Hype gap+20
- Incentives85
- Confidence45
Cloudflare Workers adds five ML-KEM and ML-DSA parameter sets to Web Crypto behind the webcrypto_modern_algorithms flag. Developers can now test post-quantum code against primitives built into the runtime, but they still have to build the protocols on top.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap0
- Incentives55
- Confidence62
Cloudflare has agreed to buy a GlobalSign root and applied to four browser root programs to become a public certificate authority. It has not issued a certificate yet, and its post-quantum certificates are aimed at Chrome's quantum-resistant root store in early 2027.
Reality
- Evidence55
- Adoption5
- Hype gap+20
- Incentives72
- Confidence60
Cloudflare plans to become a public certificate authority and issue post-quantum Merkle Tree Certificates from early 2027. Sites it fronts will manage both kinds from one system, so the planning work falls on old devices that will never add a new root.
Reality
- Evidence45
- Adoption5
- Hype gap+20
- Incentives55
- Confidence42
The IETF published RFC 10008 in June 2026 and IANA registered QUERY as safe and idempotent, so a structured read no longer has to travel as a POST. Whether the response stays cacheable depends on the caches on the path.
Reality
- Evidence68
- Adoption15
- Hype gap+5
- Incentives
- Insufficient
- Confidence65
AWS and Microsoft are already shipping ML-KEM hybrid groups, so the question for platform teams is whether the old proxy, SDK and appliance in the path still complete a handshake that got bigger.
Reality
- Evidence40
- Adoption55
- Hype gap+10
- Incentives20
- Confidence45
Identity Digital has moved its agent identity work into a separate company called Known Systems AI. The pitch is a persistent credential that says which firm answers for an agent wherever it goes.
Reality
- Evidence30
- Adoption12
- Hype gap+45
- Incentives78
- Confidence35
Publishing p=none starts an XML report feed and enforces nothing. A practitioner sequence for getting a domain to p=reject turns on an owned sender inventory, aligned DKIM and a written condition for each step.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives20
- Confidence55
RFC 9989 removed the pct tag on 19 May 2026, and a record still carrying pct=25 describes a staged rollout that conforming receivers no longer honour. The replacement, t=y, gives one testing step and no percentages.
Reality
- Evidence64
- Adoption
- Insufficient
- Hype gap+18
- Incentives22
- Confidence58
The spec's own boundary list says a verified catalog entry establishes which domain claims a capability and what trust material it published. It says nothing about whether the calling process is the agent it names.
Reality
- Evidence45
- Adoption18
- Hype gap−10
- Incentives30
- Confidence45
Verifiable credentials are a data format and zero-knowledge proofs are a technique. The layer that decides what a user sees, and what every verifier implements, is the disclosure mechanism, and for EU wallets it is already picked.
Reality
- Evidence45
- Adoption30
- Hype gap+25
- Incentives65
- Confidence35
RFC 9849 encrypts the ClientHello, so the domain field that SNI allowlists and passive TLS logs depend on stops appearing on the wire. In return, operators inherit a key rotation duty; the spec sets no fixed interval.
Publishers:rfc-editor.org
Reality
- Evidence88
- Adoption
- Insufficient
- Hype gap−10
- Incentives20
- Confidence74
Ring's new TAKE encryption deletes its own copy of video keys within 24 hours, reshaping what law enforcement can legally obtain from the cloud.
Reality
- Evidence58
- Adoption22
- Hype gap+24
- Incentives78
- Confidence52
A dev.to tutorial wraps MCP handlers so every tool call returns an Ed25519-signed receipt. The signature covers the wire. It does not cover the process doing the signing.
Reality
- Evidence28
- Adoption7
- Hype gap+52
- Incentives86
- Confidence44
A paper scores five agent interoperability protocols against six governance dimensions and finds they coordinate tasks without expressing who may approve, how dissent survives, or when a human is called.
Reality
- Evidence38
- Adoption15
- Hype gap+28
- Incentives85
- Confidence34
A practitioner's guide argues most live streaming failures start by collapsing ingest and delivery into a single choice. The rest come from a player buffer nobody checked.
Reality
- Evidence44
- Adoption
- Insufficient
- Hype gap−6
- Incentives24
- Confidence42
X25519MLKEM768 leaves the TLS application surface alone and moves the cost into handshake bytes. The work now is knowing which group each connection actually negotiated.
Reality
- Evidence58
- Adoption42
- Hype gap−12
- Incentives28
- Confidence55