10/05/2026
In 2019, breaking RSA-2048, the encryption that still protects much of the internet, was estimated to need 20 million qubits. In February 2026, the Pinnacle Architecture estimate put it below 100,000.
That is 200 times smaller in seven years. A Google Quantum AI estimate had already dropped it under 1 million in May 2025. Google and Cloudflare have both set 2029 as their post-quantum deadline, and NIST proposes deprecating RSA-2048 after 2030 and disallowing it after 2035.
AI is part of why this is moving fast. Google Quantum AI and Google DeepMind used AI to improve quantum error correction with AlphaQubit in 2024. My view is that we now have roughly two years to prepare. The Global Risk Institute is more cautious and puts the chance of a code-breaking quantum computer within ten years at 28 to 49 percent. Both timelines lead to the same to-do list.
Four things worth doing this quarter, whatever you build.
Step 1. List every place you rely on RSA or elliptic-curve signatures, such as software updates, signed documents, logins and certificates.
Step 2. Ask each vendor for its post-quantum roadmap and a date, in writing.
Step 3. Start with what must stay trustworthy for years, like contracts, archives, firmware and anything published under your name.
Step 4. Test ML-DSA (NIST FIPS 204) in one real signing pipeline before a deadline forces it.
For content, we built the Trust Identity Protocol® (TIP), and it is available now. TIP fingerprints each piece of content with SHAKE-256 and signs it with your key, which you unlock with a passkey. Each signed file becomes a Verifiable Asset with a public record of who made it, when, and whether it has changed since. It does not prove the content is true, and we say so plainly.
Three companies are already building on it. Ross Thorpe leads Rooverse, Issa Nesheiwat leads Apex Modular Solutions, and Hema Dey leads Iffel International Inc., whose One Brain is adopting TIP. Ross and Issa are Founding Members of the AI Trust Council™ and Hema is a Council Advisor, so we say that openly too.
Where does your organization still depend on RSA signatures? Tell me below and I will reply to every answer.
