Insights that help security teams make better decisions.

39.5% of 276 Swiss organisations already negotiate a post-quantum key exchange on their public site. Swiss banks lead six comparable banking centres. Measured, not surveyed.

The official CNSA 2.0 timeline from NSA and CNSSP 15: new acquisitions from 1 January 2027, phase-out by 2030, CNSA 2.0 mandated by 2031.

Hybrid post-quantum TLS explained: how X25519MLKEM768 works, RFC 10024 groups and sizes, browser and server support, how to enable and test it.

Post-quantum code signing explained: LMS, XMSS, ML-DSA and SLH-DSA compared, CNSA 2.0 rules, state management and a migration plan for firmware.

How DuoKey uses Securosys Primus HSM and CloudHSM as a key backend: Microsoft 365 DKE, PQC keys in hardware, PKCS#11. When to combine the two.

How threshold cryptography protects keys: t-of-n shares, signing without rebuilding the key, the key lifecycle, NIST's threshold work and when to use it.

How HashiCorp Vault auto-unseal with an HSM works: the PKCS#11 seal, Enterprise requirement, recovery keys, seal wrap, and an HSM-free option using MPC.

Post-quantum cryptography explained: why RSA and ECC break, FIPS 203, 204 and 205 compared, hybrid mode, deadlines to 2035 and where to start.

Secure code signing in 2026: keep signing keys in an HSM or vault, sign Authenticode, JAR, Git commits, container images and firmware remotely, under approval.