Also mentioned
TLSTLSTransport Layer SecurityTransport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Read the full entry (new tab), NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry (new tab), PQCPQCpost-quantum cryptographyCryptographic algorithms designed to run on today's classical computers while remaining secure against attacks by both classical and future quantum computers.Read the full entry (new tab), CNSACNSACommercial National Security Algorithm SuiteThe Commercial National Security Algorithm Suite 2.0, the NSA's mandated algorithm set for US National Security Systems.Read the full entry (new tab) are defined in the glossary.
Read this first
The PQC Observatory now tracks a fixed panel of 201 government and public-sector websites, measured separately from the commercial web so a slower population never flatters or drags the headline number. Of the 186 currently reachable, 58 (about 31%) negotiate the hybrid post-quantum group X25519MLKEM768 in TLS, against roughly 61% on the wider web panel. The United States (usa.gov), Canada (canada.ca), Mexico (gob.mx) and Brazil (gov.br) still complete a classical handshake, while the United Kingdom (gov.uk), Germany (bund.de), Japan, Sweden, Austria and a long tail of smaller states already offer hybrid. Much of that adoption is inherited from a CDN rather than chosen, which is exactly why a public, per-site series is worth keeping.
Governments are the loudest voice in the post-quantum transition. The United States set the deadlines almost everyone else cites: NIST IR 8547 deprecates classical public-key cryptography after 2030 and disallows it after 2035, while NSA CNSA 2.0 holds national-security systems to its own earlier line: exclusive post-quantum use by 2033. The European Union is pulling critical-infrastructure operators along through NIS2. So a fair question is whether the institutions writing the mandates have moved first on the systems the public actually touches. We added a panel to measure it.
What we measured
We assembled a fixed panel of 201 official national-government and public-service sites, the front doors a citizen or a foreign national would actually reach: national portals, foreign ministries, immigration and visa services, and the like, spread across every region we could source a canonical domain for. Once a day the observatory opens two or three read-only TLS connections to each one and records whether the server selects the hybrid group X25519MLKEM768, along with its certificate posture and whether it offers and honours session resumption. The figures below were measured with a single handshake per host; resumption, and the second and third connections it needs, were added on 28 August 2026. Read-only either way, no credentials, no exploitation, the same restrained method the observatory uses everywhere. The panel lives in the open in the pqc-observatory repository, and anyone can propose a site or ask for one to be removed.
The number, and why it sits on its own
Of the 186 government sites reachable in the latest run, 58 negotiate hybrid key exchange, just under a third. The wider web panel, the CDNs, clouds and security vendors that lead this curve, sits near 61%. That gap is the point, and it is why the government panel is kept out of the headline adoption figure entirely: it is a different and slower population, moving on procurement cycles rather than a config flag, and averaging the two would tell you nothing true about either. You can switch between the two panels on the observatory, each with its own KPIs.
The pattern is not the one you would guess
The countries that authored the deadlines are, on their public portals, behind the countries that did not. usa.gov, canada.ca, gob.mx and gov.br still complete a classical handshake. Meanwhile gov.uk, Germany's bund.de, Japan, Sweden's government.se, Austria's oesterreich.gv.at and a scattering of much smaller states, Iceland, Andorra, Liechtenstein, Qatar, Saudi Arabia, Jordan, are already offering hybrid to anyone who connects. A citizen in Reykjavik reaches a post-quantum handshake from their government today; a citizen in Washington does not.
It would be easy, and wrong, to read that as a league table of national competence. Most of the migrated sites did not make a sovereign cryptographic decision at all: they sit behind a content delivery network that turned hybrid key exchange on by default, and the government inherited it. A small nation on Cloudflare shows up green; a large one serving from its own infrastructure shows up classical, regardless of which has the more serious cryptography program. That is not a footnote to hide, it is half the finding: for most of the public web, post-quantum adoption today is a story about who your CDN is, and sovereign systems that terminate their own TLS are precisely the ones still doing the work by hand.
Why a handshake is the floor, not the ceiling
Negotiating X25519MLKEM768 protects this session's traffic against a future quantum adversary harvesting it now to decrypt later. It says nothing about the certificate chain, the internal systems behind the portal, or the decades of data a government already holds. Those are the parts a migration has to schedule, and none of them show up in a handshake. A green handshake is the most visible and least sufficient step, which is the honest way to read this panel: it is a public, cheap, continuously updated proxy for whether an institution has started, not a certificate that it has finished, and establishing the latter takes an audit of what sits behind the front door. The value is the trend, measured the same way every day, on a series nobody can backfill later. See the harvest-now-decrypt-later argument for why the clock started before the mandates did.
Read it, and correct it
The government panel is public, searchable, and shows each site with the country we derive from its domain and the status of its latest handshake. If a site belongs on it and is missing, or is measured wrong, the panel is a pull request away. We would rather be corrected in the open than quietly approximate.
References
- PQC Observatory, government panel - the live series this post reads from.
- NIST IR 8547 - Transition to Post-Quantum Cryptography Standards - the source of the 2030 / 2035 deadlines.
- pqc-observatory - the open panel and probing policy.
- Harvest now, decrypt later - why retained government data is exposed today.
- draft-ietf-tls-ecdhe-mlkem: the hybrid groups the panel is probed for.