{
    "status": "pilot",
    "generated": "2026-11-04",
    "disclaimer": "Illustrative reference service. Readiness comes only from editor-approved PQC navigator assertions; a product that supports an algorithm does not mean the service can migrate. Dates are unknown unless published; nothing here is agreed between parties. Not compliance advice.",
    "service": {
        "id": "eidas-qualified-signatures",
        "title": "Qualified electronic signatures and seals with a qualified trust service provider",
        "illustrative": true,
        "summary": "An organisation signs documents with qualified certificates from a qualified trust service provider, whose keys sit in a qualified signature creation device; recipients validate the signatures with their own software against the EU trusted lists.",
        "limitations": "A generic template. ETSI TS 119 312 lists post-quantum signature suites, but leaves migration dates to a document still being prepared; no date for qualified trust services is recorded here.",
        "compiled": "2026-10-23"
    },
    "components": [
        {
            "id": "qtsp-signing-device",
            "label": "Qualified signature creation device or remote signing HSM",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "HSM key storage and operations",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "trust-framework",
            "label": "Profiles and migration rules for qualified services",
            "controlled_by": "Standards body or supervisor (outside the plan)",
            "function": "Certificate signatures",
            "chosen_release": null,
            "readiness": "No agreement recorded between the parties",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "qtsp-ca",
            "label": "Qualified trust service provider's certificate authority",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "PKI / CA certificate issuance",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "qtsp-signing-device",
                "trust-framework"
            ],
            "blocked_by": [
                "qtsp-signing-device",
                "trust-framework"
            ]
        },
        {
            "id": "signing-application",
            "label": "Signing application of the organisation",
            "controlled_by": "Own organisation",
            "function": "Algorithms in the cryptographic API",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "qtsp-ca"
            ],
            "blocked_by": [
                "qtsp-ca",
                "qtsp-signing-device",
                "trust-framework"
            ]
        },
        {
            "id": "relying-party-validation",
            "label": "Recipients' signature validation software",
            "controlled_by": "Counterparty (the other organisation or its users)",
            "function": "Algorithms in the cryptographic API",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "qtsp-ca"
            ],
            "blocked_by": [
                "qtsp-ca",
                "qtsp-signing-device",
                "trust-framework"
            ]
        }
    ],
    "plan": [
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "qtsp-signing-device",
            "component_label": "Qualified signature creation device or remote signing HSM",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Qualified signature creation device or remote signing HSM and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "authority",
            "party_label": "Standards body or supervisor (outside the plan)",
            "step": "configuration",
            "step_label": "Compatible configuration agreed",
            "component": "trust-framework",
            "component_label": "Profiles and migration rules for qualified services",
            "readiness": "No agreement recorded between the parties",
            "action": "Agree Profiles and migration rules for qualified services between the parties concerned and record who agreed and when.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "qtsp-ca",
            "component_label": "Qualified trust service provider's certificate authority",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Qualified trust service provider's certificate authority and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-qtsp-signing-device",
                "c-trust-framework"
            ],
            "waits_for_labels": [
                "Qualified signature creation device or remote signing HSM",
                "Profiles and migration rules for qualified services"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "signing-application",
            "component_label": "Signing application of the organisation",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Signing application of the organisation and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-qtsp-ca"
            ],
            "waits_for_labels": [
                "Qualified trust service provider's certificate authority"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "counterparty",
            "party_label": "Counterparty (the other organisation or its users)",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "relying-party-validation",
            "component_label": "Recipients' signature validation software",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Recipients' signature validation software and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-qtsp-ca"
            ],
            "waits_for_labels": [
                "Qualified trust service provider's certificate authority"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "interop-test",
            "step_label": "Interoperability test",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Run a joint interoperability test of the whole chain in a test environment and record its scope and result.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-qtsp-signing-device",
                "c-trust-framework",
                "c-qtsp-ca",
                "c-signing-application",
                "c-relying-party-validation"
            ],
            "waits_for_labels": [
                "Qualified signature creation device or remote signing HSM",
                "Profiles and migration rules for qualified services",
                "Qualified trust service provider's certificate authority",
                "Signing application of the organisation",
                "Recipients' signature validation software"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "pilot",
            "step_label": "Pilot",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Pilot the service with a limited group, keeping the classical fallback.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-interop-test"
            ],
            "waits_for_labels": [
                "Interoperability test"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "rollout",
            "step_label": "Staged rollout",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Roll out in stages agreed by every party.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-pilot"
            ],
            "waits_for_labels": [
                "Pilot"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "validation",
            "step_label": "Validation",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Validate that the post-quantum mechanisms are actually negotiated or verified on every hop.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-rollout"
            ],
            "waits_for_labels": [
                "Staged rollout"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "retire-legacy",
            "step_label": "Retirement of the legacy fallback, when authorised",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Retire the classical-only fallback only when every party has authorised it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-validation"
            ],
            "waits_for_labels": [
                "Validation"
            ],
            "date": "Unknown: no date published or agreed"
        }
    ],
    "milestones": [
        {
            "id": "eu-pqc-milestone-2026",
            "date": "2026-12-31",
            "date_text": "By 31 December 2026",
            "title": "EU roadmap milestone 1: first steps and national roadmaps",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2030",
            "date": "2030-12-31",
            "date_text": "By 31 December 2030",
            "title": "EU roadmap milestone 2: high-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2035",
            "date": "2035-12-31",
            "date_text": "By 31 December 2035",
            "title": "EU roadmap milestone 3: medium-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        }
    ],
    "interop": [
        {
            "id": "hackathon-ml-dsa-65-certificates",
            "title": "IETF PQC Hackathon: ML-DSA-65 X.509 certificate artifacts",
            "result": "Passed within the stated scope",
            "scope": "Parsing and verifying self-signed ML-DSA-65 certificate artifacts from 17 producers with 4 verifiers (Bouncy Castle, a composite reference implementation, OpenSSL and QUBIP Aurora): all 68 pairs passed.",
            "limitations": "Artifact test, not a TLS handshake or a deployed service. The page names submitters, not product releases or builds, so it does not apply to a particular release listed here. Not a certification.",
            "url": "https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r5_automated_tests.html",
            "results_date": "2026-10-06",
            "retrieved": "2026-10-23"
        },
        {
            "id": "hackathon-ml-dsa-65-private-keys",
            "title": "IETF PQC Hackathon: ML-DSA-65 private key formats",
            "result": "Failed within the stated scope",
            "scope": "Reading ML-DSA-65 private key files with the OpenSSL parser: seed-format keys from 10 producers were accepted and those from 2 producers, Botan and one other submitter, were rejected; the same 2 failed the seed and expanded-key consistency check.",
            "limitations": "The results page does not state why the files were rejected; the run logs are linked from the project index. Applies to the submitted artifacts only, not to a product release, and says nothing about certificates or signatures.",
            "url": "https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r5_automated_tests.html",
            "results_date": "2026-10-06",
            "retrieved": "2026-10-23"
        }
    ]
}