Summary

Sigstore's PQC blog post committed to ML-DSA support, and the groundwork has been laid (protobuf-specs define ML-DSA algorithm IDs, Trail of Bits built cryptographic agility, --signing-algorithm flag exists). But cosign itself cannot generate ML-DSA keys, sign with ML-DSA, or verify ML-DSA signatures today.

This issue tracks the remaining work to deliver ML-DSA support in cosign.

What's Already Done

What's Missing

# These should work but don't yet:
cosign generate-key-pair --algorithm ml-dsa-65
cosign sign --key cosign.key myregistry/myimage:latest
cosign verify --key cosign.pub myregistry/myimage:latest

Specifically:

• ML-DSA key pair generation in cosign CLI
• ML-DSA signing of container images and artifacts
• ML-DSA signature verification
• Fulcio ML-DSA certificate issuance (ephemeral keys)
• Rekor ML-DSA signature storage and verification
• Hybrid mode: dual-sign with ECDSA + ML-DSA for backward compatibility
• Remove "Experimental" status from protobuf-specs ML-DSA entries

Blocker Status

The blog post cited Go's crypto/mldsa as the blocker for public instance adoption.
This blocker is resolving: Go 1.27's crypto/mldsa proposal has been
Accepted and will ship ~Aug/Sep 2026 with a public API for ML-DSA-44, ML-DSA-65, and ML-DSA-87.

Why This Matters

Container images and software artifacts may be verified years after signing. Unlike TLS (where the handshake is ephemeral), a signature on a container image persists indefinitely. This makes supply chain signing a prime target for "harvest now, forge later" attacks - an adversary who obtains a quantum computer could forge ECDSA signatures on existing artifacts.

France's ANSSI will stop certifying non-PQC products from 2027. Supply chain security tooling needs to lead this transition.

References

• Sigstore PQC Blog Post
• Trail of Bits: Building Cryptographic Agility into Sigstore
• Red Hat: Quantum Proofing Sigstore (OpenSource SecurityCon 2026)
• Go crypto/mldsa proposal (Accepted)
• NIST FIPS 204 (ML-DSA)
• ANSSI 2027 Mandate