The Passport Problem

A Domain That Adopted Early and Is Migrating Last  

Digital identity was, in a sense, one of the earliest large-scale deployments of public-key cryptography in daily civic life. Electronic passports have carried digital signatures since the mid-2000s. National eID cards, mobile driver's licenses and, from the end of 2026, the European Digital Identity Wallet all rest on the same asymmetric cryptography that browsers and payment networks are now actively phasing out. Despite that early start, government identity systems are consistently identified as among the least quantum-ready parts of the digital trust landscape, well behind the web infrastructure that adopted public-key cryptography around the same time. 

Sources: Cloudflare, post-quantum traffic measurement, October 2025; Secure Identity Alliance, Preparing for Post-Quantum Cryptography in Identity Documents, 2026. 

The gap is not primarily a matter of institutional urgency. Governments have, if anything, been more publicly attentive to the quantum threat than many private-sector industries, issuing roadmaps, national strategies and coordinated timelines well ahead of most enterprise sectors. The gap is structural, rooted in three properties of identity documents that make them a harder migration target than a TLS certificate. 

Why Identity Documents Are a Harder Case 

Documents outlive the standard they were signed under 

A TLS certificate is typically valid for months and can be reissued the moment an organization's infrastructure is ready. A passport issued today typically remains valid for ten years. A national eID card can carry a similarly long lifespan. A document signed in 2026 under current cryptography will still be in active circulation well past the point at which most credible estimates place the arrival of a cryptographically relevant quantum computer. 

This creates a threat model distinct from harvest-now-decrypt-later data collection. The risk to an identity document is not that its contents will be read by an adversary years later. It is that the signature verifying the document's authenticity could eventually be forged, undermining the very function the document exists to serve, at a point when the document is still legally valid and in active use at a border or a bank counter. 

The hardware was not built for post-quantum key sizes 

Electronic passport chips are constrained, low-cost, contactless smart card components, standardized by ICAO with a typical minimum storage budget on the order of 32 kilobytes for the full data page, biometric templates and cryptographic material combined. Classical signature schemes fit this budget comfortably. Several post-quantum candidates do not. 

Academic analysis of post-quantum certificates for electronic travel documents has found that none of the standard post-quantum signature schemes fit within the current ICAO chip storage specification once combined with the rest of the required data. Falcon, the more compact lattice-based option now progressing toward standardization as FN-DSA, offers the most workable path within existing constraints, but even it requires ICAO's technical specifications to be revised before a compliant chip can be manufactured at scale. This is not a software update. It is a hardware and standards-body problem that has to be resolved before migration can begin in earnest.  

A browser can negotiate a new key exchange algorithm overnight. A passport chip has to be manufactured, specified, and issued years before the document reaches a citizen's pocket. 

Standards move through a slower, multilateral process 

TLS migration is coordinated largely by a handful of browser vendors and certificate authorities who can push updates on their own schedule. Identity document standards move through ICAO for passports and through national or EU-level bodies such as eIDAS for digital wallets, processes that require multilateral agreement across issuing states for the resulting documents to remain interoperable at every border and verification point worldwide. The European Digital Identity Wallet, mandatory for all EU member states by the end of 2026, is being built largely on today's cryptographic foundations, with post-quantum migration treated as a subsequent phase of the roadmap rather than a launch requirement. 

What Early Movement Looks Like 

The Secure Identity Alliance has recommended that identity document issuers begin cryptographic preparation as early as 2026, explicitly warning that introducing new cryptography into large field deployments can take years, long enough to risk overlapping with the period in which quantum computers become a practical threat. The European Commission's evolving eIDAS roadmap and national efforts in agencies working with NIST, ANSSI and Germany's BSI reflect a similar recognition. What is largely absent so far is a resolved technical path: a finalized signature scheme that fits existing chip constraints, an ICAO specification updated to accommodate it, and a rollout plan for the billions of physical and digital credentials already in circulation. 

Implications Beyond the Passport 

Government-issued identity increasingly functions as the trust root for systems well outside passport control, including eIDAS-based authentication for banking, national digital identity wallets used for facility and service access, and, in some jurisdictions, physical access control at critical infrastructure sites. Organizations that rely on national identity credentials as part of an authentication chain are inheriting this timeline whether or not they operate any identity infrastructure themselves. Where that reliance intersects with physical or network access to critical systems, continuous behavioral monitoring of the resulting access, the approach Outis applies within OT/ICS and corporate networks, provides a compensating layer of assurance that does not depend on the identity document's underlying cryptography being resolved first. 

Recommendations 

• Identity document issuers should begin cryptographic inventory and engagement with ICAO and regional standards bodies now, treating the multi-year hardware and standards timeline as the binding constraint rather than the algorithm choice itself. 

• Prioritize signature schemes with the smallest practical footprint, such as Falcon/FN-DSA, for hardware-constrained credentials, while tracking further NIST guidance as it finalizes. 

• Treat documents issued from 2026 onward as carrying quantum exposure across their full validity period, and evaluate whether shorter validity cycles are warranted for newly issued high-assurance credentials until PQC-capable chips are available. 

• Organizations relying on government-issued digital identity for access control should pair that reliance with continuous, behavioral monitoring of the access it grants, rather than treating the credential's cryptographic assurance as a complete control on its own. 

A short demonstration remains the most direct way to assess how Outis performs at the operator level within a specific network environment.