The signature you sign today must survive 2035.
The quantum computing transition is not a future concern — it is a current threat. "Harvest now, decrypt later" attacks are already operational: adversaries intercept and archive today's encrypted traffic, waiting for the quantum capability to break it. For AI agents that sign payment mandates, identity attestations, or legal authorizations, the exposure window is already open.
The fundamental problem is longevity. A mandate signed today with current elliptic-curve cryptography will still carry legal weight in 2035. The signature protecting it will not. NIST finalized its first post-quantum cryptographic standards in 2024 — lattice-based algorithms that quantum computers cannot efficiently attack. The migration window is now, not after Q-Day.
The agent economy adds complications that a simple library swap cannot resolve. Agents sign on behalf of principals, delegate authority in chains, and operate across payment rails spanning multiple jurisdictions. A post-quantum transition requires rethinking how authority is delegated, verified, and revoked across a distributed agent stack — not just replacing the signature primitive at the leaf.
Our work at this crossing covers the full trust stack: quantum-safe signature schemes for agent mandates, quantum-resistant key exchange for agent-to-agent communication, and audit structures that remain tamper-evident under quantum adversaries. We open-source these primitives so the agent ecosystem can migrate without each application rebuilding the same foundation. The infrastructure layer should be shared; differentiation sits above it.