Why Your Firm's Email Signatures Are PQC-Vulnerable Today

Published: April 2026 | 8 min read

Your email signature today is a digital afterthought. A name, a title, a phone number—maybe a company logo. If your firm uses S/MIME (Secure/Multipurpose Internet Mail Extensions) to cryptographically sign correspondence, you're using RSA-2048 or ECDSA, algorithms that a sufficiently resourced quantum computer can break retroactively. Every email your firm sent in the past decade could be forged retroactively once quantum breaks the encryption.

This isn't theoretical. Harvest-now-decrypt-later attacks are operationalized. Adversaries are recording encrypted communications *today*, betting they'll have quantum capability in 5-15 years. Your privilege logs, your settlement instructions, your witness testimony emails—all candidates for retroactive forgery.

The Current Signature Architecture

S/MIME works like this: your email client signs outbound mail with your private RSA key. The recipient uses your public certificate (stored in your firm's directory) to verify the signature. If the signature validates, the recipient trusts the message came from you and wasn't tampered with.

The problem: RSA-2048 (the standard today) relies on the computational hardness of integer factorization. Shor's algorithm, implemented on a quantum computer with ~4,000 logical qubits, breaks this in polynomial time. Estimates vary, but NIST projects cryptographically relevant quantum computers in 10-20 years. Your client confidences, your litigation strategy emails, your settlement negotiations—all logged in opposing counsel's email archives, waiting.

Post-Quantum Cryptography: ML-DSA-65

ML-DSA-65 (Module-Lattice-Based Digital Signature Algorithm) is the NIST-standardized post-quantum alternative. It's based on the hardness of the Learning With Errors (LWE) problem, which even quantum computers cannot solve efficiently. A signature made today with ML-DSA-65 is quantum-resistant retroactively—meaning, even if quantum breaks RSA tomorrow, that signature remains valid and unforgeably yours.

For litigation purposes, this is critical. Your trial exhibits include emails signed with ML-DSA-65. Your auditor doesn't need our clearing house to verify them—they check the signature against the public key. The mathematics of lattice-based cryptography are Daubert-admissible. The signature is mathematically non-repudiable and resistant to quantum forgery.

The Transition Path

Firms can't flip a switch overnight. The transition will unfold in phases:

• Phase 1 (2026-2027): Issue new certificates with ML-DSA-65 alongside existing RSA keys (hybrid mode). Outbound mail is dual-signed.
• Phase 2 (2027-2029): ML-DSA-65 becomes primary; RSA signatures sunset.
• Phase 3 (2029+): Legacy RSA-signed emails are re-attested via Sovereign Receipts for litigation purposes.

Sovereign Receipts as Retroactive Armor

For emails sent before your firm transitions to ML-DSA-65, Sovereign Receipts provide a legal backstop. When a communication passes through the Clearing House, it receives a receipt signed with ML-DSA-65, timestamped, and recorded on an immutable ledger. The receipt binds the original email, the timestamp, and your firm's identity. Even if the original email's RSA signature is compromised, the Clearing House receipt—quantum-resistant—proves non-tampering at the moment of receipt.

In litigation, you produce both: the original email + its Sovereign Receipt. Your auditor verifies the receipt offline against the clearing house's public ML-DSA-65 key. The mathematics prove the email was received unaltered on that date, by that recipient, from your authenticated identity.

Action Steps for Your Firm

• Audit current email certificate inventory: What algorithm? What expiration? What renewal plans?
• Engage your PKI vendor (DigiCert, GlobalSign, Entrust) on post-quantum roadmaps for S/MIME.
• For litigation-critical communications (privilege logs, discovery, settlement), start routing through Sovereign Receipt infrastructure now.
• Brief your technology partner on NIST post-quantum standards and your firm's 24-month transition timeline.