OpenSSF Community Day North America 2026

Implementing post quantum cryptography in supply chain security requires decisions beyond algorithm selection, with trade offs impacting performance and storage. This talk explores three approaches for adding PQC into Sigstore, the open standard for signing and verifying artifacts. The first maintains classical certificates, adding PQC signatures to transparency log inclusion proofs. The second implements hybrid X.509 certificates with dual classical/PQC signatures, modifying signing, verification and transparency components. The third leverages merkle tree certificates, embedding PQC commitments for efficient batch verification with minimal overhead. The talk presents prototypes, demonstrates post quantum signing and verification, reveals compromises in each approach and how assumptions in existing code created unexpected challenges. Attendees gain understanding of each method, providing a foundation for contributing to community discussions around post quantum adoption.