The NSA press release announcing its Post-Quantum Cryptography Resource Hub restates two dates that have been in CNSSP 15 since the update described in NSA's CNSA 2.0 FAQ of December 2024: new commercial National Security Systems must support quantum-resistant algorithms from 2027, and legacy systems that cannot support them are to be phased out by 2030. The release also introduces a term the policy documents did not contain. Beside "harvest now, decrypt later" it names a second threat, "trust now, exploit later".
Two threats, two timelines
Harvest now, decrypt later is a confidentiality threat. It targets key establishment, and it is active today because recorded traffic can be stored indefinitely. Trust now, exploit later is an authentication threat. A certificate or code-signing key accepted as valid today becomes a forgery tool once the private key behind it can be recovered. Exploitation requires a quantum computer. Collection of the public keys and signed artifacts can be done today. The release's list of benefits separates the two, with "protect sensitive data" as one item and "secure authentication" as another.
Vendor literature has used "trust now, forge later" for this threat since mid 2025. NSA uses "exploit", which is the accurate term. A recovered signing key does more than forge documents. It issues firmware a device will install and certificates a server will accept.
Both timelines were already in US policy. EO 14412 sets key establishment at the end of 2030 and signatures at the end of 2031 for federal high value systems. CNSA 2.0 puts software and firmware signing on the earliest category deadline, exclusive use by 2030, because signed code carries the longest trust lifetime of any category in the table. The three threat categories run on three timelines, and the authentication category now has an official NSA designation.
The release cites two of the five CNSA 2.0 dates
The CNSA 2.0 schedule runs: under CNSSP 15, January 1, 2027, new NSS acquisitions must be CNSA 2.0 compliant; December 31, 2030, equipment and services that cannot support CNSA 2.0 are phased out; December 31, 2031, CNSA 2.0 algorithms are mandated unless excepted; under the 2022 advisory, 2033, exclusive use for web browsers and servers, cloud services, operating systems and niche equipment; under NSM-10, 2035, transition complete. The full table is on the [PQ]time page. The press release and the hub cite 2027 and 2030.
A contractor working from the release alone will see no 2033 date. The category table still allows 2033 for servers and cloud services; the release leads with 2030. Contractors should plan to 2030, the date NSA chose to publish and the one procurement reviews will reference.
The hub contains three explainers, a restatement as of June 2026 that NSA does not recommend quantum key distribution, and a list of services for the Defense Industrial Base: attack surface management, continuous autonomous penetration testing, protective DNS and threat intelligence. Cryptographic inventory is absent from that list. Under EO 14412 the CBOM minimum elements come from CISA and NIST, due 270 days after the June order, which lands in March 2027, after the January acquisition gate has opened.
The Defense Industrial Base is in scope
Morgan Stern, NSA's Effort Lead for Quantum Resistance, closes the release by stating the enterprise is only as strong as its weakest link, and the release extends NSA's PQC work explicitly to the Defense Industrial Base. The DIB consists of thousands of subcontractors whose cryptographic posture is whatever their hosting and VPN vendors negotiate on their behalf. In our European cohort at least 64.5% of measured post-quantum results belonged to a CDN edge rather than to the organization measured. A DIB census taken from the same outside view would carry the same false floor: the edge reports hybrid key exchange, the origin behind it reports none, and the signature chain on both is classical. The services NSA lists measure what is exposed. None of them reports what the handshake negotiated or what signed the certificate.
Reporting against both deadlines
A posture report that answers "post-quantum: yes or no" collapses the two threats NSA has now named into one. A host can be on pace for the key establishment deadline and have no plan for the signature deadline, and under the two designations those are separate exposures with separate arrival times. [PQ]probe grades post-quantum key exchange against 2030 and records the signature algorithm of every certificate it sees, which keeps the two exposures the release names in separate fields; a report that answers yes or no has neither.
The 2027 acquisition gate is fifteen months away. In our certificate data RSA still signs roughly four out of five leaf certificates. Each one is an artifact the release now classifies as a trust now, exploit later exposure.