Why does a break of signatures matter later than a break of encryption?
Public-key cryptography is what lets strangers talk safely, and it is the half a quantum computer breaks. These topics show how each lock works and what it rests on, using numbers small enough to follow, so that topic 07 can say exactly what Shor's algorithm does to them.
A digital signature is the reverse of encryption in spirit: only the holder of a private key can produce it, and anyone with the public key can check it. It proves a message came from the key's owner and has not been changed since. A certificate is a signature on a claim: a certificate authority (CA) signs “this public key belongs to example.com until this date”. Your browser carries a list of a few hundred root CAs it trusts outright, and everything else is a chain of such signatures leading back to one of them.
That gives a certificate two algorithms, not one: the key it carries, and the algorithm its issuer used to sign it. They are usually different and usually belong to different people, so changing a website's key to a post-quantum one does nothing about the RSA signature above it. The Inventory tool on the post-quantum page is built around exactly that distinction.
The deeper point is about when a break hurts. A signature has to be forged at the moment it is accepted: a machine built in 2036 cannot reach back and forge the handshake you completed in 2026. An encrypted conversation is different, because the ciphertext can be recorded today and read whenever the machine arrives. That is why the migration order is not “fix the worst first” but “fix what is being recorded first”, and why the exceptions are signatures that live a long time: a root certificate, a software-update key, firmware burned into a device that will run for twenty years.
Hash-then-sign. Signing a long message directly would be slow, so the scheme signs its hash. With the toy RSA of topic 05 (n = 3233, e = 17, d = 2753) and a message whose hash is 1234:
σ = 1234d mod 3233 = 1512 verify: σe = 151217 mod 3233 = 1234 ✓
Only someone who knows d can produce 1512; anyone can check it with the public (n, e). Real signatures (ECDSA, EdDSA, RSA-PSS, and the post-quantum ML-DSA and SLH-DSA) differ in the mathematics but share the shape: sign the hash with the private key, verify with the public key. A certificate chain of three certificates has two such signatures to check.
Mosca's inequality. Michele Mosca's rule for when to worry: let X be how many years the data must stay secret, Y how many years your migration will take, and Z how many years until a machine that can break the scheme exists. You are exposed if
X + Y > Z
A conversation protecting secrets for X = 10 years, with a Y = 5 year migration and a machine in Z = 12 years: 10 + 5 = 15 > 12, exposed, even though the machine is not here yet. A signature accepted today has X = 0 for the forgery that matters, since a forged signature is only useful while someone is willing to accept it: 0 + 5 = 5 is not more than 12. Z is an assumption, not a forecast, and the Harvest Clock lets you put your own numbers in.
Every HTTPS site, every app store, every update Certificate chains secure web traffic. Code signing is how your phone knows an update came from the maker, DNSSEC signs DNS records, and Bitcoin's ownership rule is an ECDSA or Schnorr signature on each spend.
Which signatures should move first The ones with a long life or a hard-to-replace key: the roots at the top of a chain, anything burned into hardware, and long-term archives that must still verify in thirty years. A short-lived web certificate, replaced every few months, can wait for the tools to mature without taking on much risk, which is part of why encryption goes first and signatures second.
Check yourself
Why can a recorded encrypted conversation be attacked by a quantum computer built years later, while a signature checked today cannot be forged by it after the fact?
Mosca's rule compares how long data must stay secret with how long migration takes and when the machine arrives. A recording has a long secrecy time. A signature accepted now has essentially none for forgery, so later machines cannot go back and forge it.