Governments set the post-quantum deadlines. Their own sites are behind.

Governments are the loudest voice in the post-quantum transition. The United States set the deadlines almost everyone else cites, deprecate classical public-key cryptography after 2030 and disallow it after 2035, through NIST IR 8547 and CNSA 2.0. The European Union is pulling critical-infrastructure operators along through NIS2. So a fair question is whether the institutions writing the mandates have moved first on the systems the public actually touches. We added a panel to measure it.

What we measured

We assembled a fixed panel of 201 official national-government and public-service sites, the front doors a citizen or a foreign national would actually reach: national portals, foreign ministries, immigration and visa services, and the like, spread across every region we could source a canonical domain for. Once a day the observatory performs a single read-only TLS handshake to each one and records whether the server selects the hybrid group X25519MLKEM768, along with its certificate posture. Read-only, one connection per host per day, no exploitation, the same restrained method the observatory uses everywhere. The panel lives in the open in the pqc-observatory repository, and anyone can propose a site or ask for one to be removed.

The number, and why it sits on its own

Of the 186 government sites reachable in the latest run, 58 negotiate hybrid key exchange, just under a third. The wider web panel, the CDNs, clouds and security vendors that lead this curve, sits near 61%. That gap is the point, and it is why the government panel is kept out of the headline adoption figure entirely: it is a different and slower population, moving on procurement cycles rather than a config flag, and averaging the two would tell you nothing true about either. You can switch between the two panels on the observatory, each with its own KPIs.

The pattern is not the one you would guess

The countries that authored the deadlines are, on their public portals, behind the countries that did not. usa.gov, canada.ca, gob.mx and gov.br still complete a classical handshake. Meanwhile gov.uk, Germany's bund.de, Japan, Sweden's government.se, Austria's oesterreich.gv.at and a scattering of much smaller states, Iceland, Andorra, Liechtenstein, Qatar, Saudi Arabia, Jordan, are already offering hybrid to anyone who connects. A citizen in Reykjavik reaches a post-quantum handshake from their government today; a citizen in Washington does not.

It would be easy, and wrong, to read that as a league table of national competence. Most of the migrated sites did not make a sovereign cryptographic decision at all: they sit behind a content delivery network that turned hybrid key exchange on by default, and the government inherited it. A small nation on Cloudflare shows up green; a large one serving from its own infrastructure shows up classical, regardless of which has the more serious cryptography program. That is not a footnote to hide, it is half the finding: for most of the public web, post-quantum adoption today is a story about who your CDN is, and sovereign systems that terminate their own TLS are precisely the ones still doing the work by hand.

Why a handshake is the floor, not the ceiling

Negotiating X25519MLKEM768 protects this session's traffic against a future quantum adversary harvesting it now to decrypt later. It says nothing about the certificate chain, the internal systems behind the portal, or the decades of data a government already holds. A green handshake is the most visible and least sufficient step, which is the honest way to read this panel: it is a public, cheap, continuously updated proxy for whether an institution has started, not a certificate that it has finished. The value is the trend, measured the same way every day, on a series nobody can backfill later. See the harvest-now-decrypt-later argument for why the clock started before the mandates did.

Read it, and correct it

The government panel is public, searchable, and shows each site with the country we derive from its domain and the status of its latest handshake. If a site belongs on it and is missing, or is measured wrong, the panel is a pull request away. We would rather be corrected in the open than quietly approximate.

References

• PQC Observatory, government panel - the live series this post reads from.
• NIST IR 8547 - Transition to Post-Quantum Cryptography Standards - the source of the 2030 / 2035 deadlines.
• pqc-observatory - the open panel and probing policy.
• Harvest now, decrypt later - why retained government data is exposed today.