2026-07-10 · cloudflare
Cloudflare published a fresh warning on post-quantum signatures, arguing that the next generation of stronger schemes will arrive too late for organizations that need to protect data today. Its position is blunt: use the best available post-quantum signature option now instead of waiting for something cleaner later. That matters for cold storage because backups are supposed to survive for years, sometimes decades. If the cryptography protecting identity, software provenance, or recovery workflows ages out before the archive does, the value of the backup can erode right when you need it most.
Cloudflare says classical signature systems like RSA and ECC are on borrowed time against sufficiently capable quantum attacks, while newer candidate schemes are not mature enough to wait for. The post argues for moving ahead with available standards now, especially for systems that need long-term authenticity and resistance against harvest-now-decrypt-later strategies.
Backups are not just about storing bytes; they also depend on durable trust in keys, signatures, and recovery procedures. If old signing systems become unreliable, organizations can face corrupted restore chains, unverifiable artifacts, and expensive emergency migrations under pressure.
Cold storage helps by separating high-value recovery material and signing authority from constantly exposed online systems. When paired with offline key custody, periodic cryptographic refreshes, and immutable backup handling, it reduces the chance that one online compromise or future cryptographic break wipes out both production access and recovery trust.
Read Original Post →