Cloudflare Builds Public Certificate Authority for Post-Quantum Web Security
Cloudflare's Merkle Tree Certificate tests point to a way to keep post-quantum handshakes from becoming much heavier.
Cloudflare ran a Chrome Beta 146 experiment serving billions of Merkle Tree Certificates to half of that browser population for selected free-plan domains, and reported a 9% improvement in median performance. Most of that gain came from dropping intermediate certificates, and the test used classical rather than post-quantum signatures. The company has since ended the experiment in August 2026 and is building a public certificate authority that issues these certificates, with a goal of entering Chrome's quantum-resistant Root Store in early 2027 pending review. For developers this matters because post-quantum signatures are about forty times larger than classical ones, so a log-based design that verifies compact inclusion proofs could ease the bandwidth cost of the coming migration. Open questions remain around revocation and incident response, and the approach still needs independent monitoring and broader browser support before it can be widely deployed.
Why it matters
Post-quantum signatures are far larger than the classical ones browsers use today, which threatens to slow down secure connections across the web. Cloudflare's test suggests a log-based design, where the browser checks a compact inclusion proof instead of a long chain of intermediate certificates, could offset much of that cost. The public certificate authority it is building would make the approach available beyond one company, and its planned entry into Chrome's quantum-resistant Root Store in early 2027 would be a test of whether it can be trusted at scale. Revocation, incident response and wider browser support remain unresolved, so the approach has not yet been proven.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.