FOR IMMEDIATE RELEASE

TORONTO, October 23, 2026 — Federal agencies faced an October 22 deadline this week to submit post-quantum cryptography (PQC) transition plans to the Office of Management and Budget, targeting PQC-hardened authentication for "high-value" federal systems by 2030. But according to new analysis from the R Street Institute, the certification pipeline meant to assure the quality of cryptographic modules has itself become the obstacle: NIST's Cryptographic Module Validation Program (CMVP) is running with a backlog of 203 modules in process and an average validation period of 348 days, and only 16 PQC implementations carried FIPS 140-3 certification as of September 2026 — leaving agencies choosing from a pool of eight or nine vendors.

Securetron says the bottleneck story extends well beyond federal procurement. For enterprises, the constraint is visibility: you cannot migrate, re-key, or swap out cryptography you have not inventoried.

"The federal side is a queue problem — too few validators, too many modules," said Sarah Reid, Securetron spokesperson. "The enterprise side is a visibility problem. Harvest-now-decrypt-later is already happening, so every certificate with a long trust horizon issued by algorithms quantum computing will break is already a risk. But most organizations can't produce a complete, current inventory of their certificates — public, private, machine, cloud — let alone automate the renewals a migration will demand. You don't get to post-quantum without a governed lifecycle first."

PKI Trust Manager, Securetron's certificate lifecycle management platform, is built around that foundation. It continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise — "no blind spots, no spreadsheets" — and automates issuance, renewal, and monitoring end to end. A built-in RFC 8555 ACME server with EAB, plus SCEP and EST, lets certbot, acme.sh, win-acme, and network devices enroll automatically. Configurable expiry alerting with routing eliminates certificate-expiry outages, and a single compliance pane spans ADCS, MSCA, Let's Encrypt, DigiCert, and ACME sources with full audit trails for every action.

For organizations facing a migration, onboarding is the hard part — and Securetron attacks it with Boltron-AI, its AI agent module for PKI operations. Boltron-AI maps endpoints, services, and certificate stores across the infrastructure, inventories and profiles each application (certbot, acme.sh, sscep, IIS, Apache, Tomcat, and more), and generates step-by-step runbooks that onboard each application to PKI Trust Manager — then PKI Trust Manager takes over issuance, renewal, and monitoring.

"The R Street analysis is right that the government created the CMVP bottleneck and can remove it," Reid added. "Enterprises should apply the same discipline to their own estate. Before you argue about algorithms, answer the inventory question: what certs do you have, where do they live, and can you renew them all without a spreadsheet and a weekend? That's what our platform does every day — discovery to automation in four steps."

PKI Trust Manager is available as a free Community Edition managing up to 500 certificates — deployable on-premises or via PKI Trust Cloud, which offers fully managed certificate lifecycle management with free signup. No infrastructure is required to start.

About Securetron

Securetron builds enterprise security infrastructure: PKI Trust Manager and PKI Trust Cloud automate certificate lifecycle management — discovery, issuance, renewal, expiry alerting, and compliance audit — for every certificate across the enterprise, with AI-driven onboarding via Boltron-AI. For more information, visit https://securetron.net.

Press contact:

Sarah Reid

Securetron

1 Yonge St, Toronto, ON M5E 1E6, Canada

+1 (438) 927-8036

[email protected]

###