Post-quantum arrived in a phone

Google announced the Pixel 11 line on 12 August, and the part worth reading twice was not the camera. All four models ship a Titan M3 security coprocessor that adopts the post-quantum cryptography standards set by the US National Institute of Standards and Technology. It handles quantum-safe secure boot, runs Trusty as the trusted execution environment, and carries Common Criteria certification at the level used for SIM and bank cards. Google says it is the first Pixel to meet those standards (Google, 2026).

The Tensor G6 numbers will take the coverage. A 2nm part, 50 per cent more TPU compute, on-device AI that Google claims runs up to 3.5 times faster on up to 3.5 times less energy. All fine, all incremental. The security chip is the one that changes a document we write.

Harvest now, decrypt later

The threat is not a quantum computer turning up and reading your traffic live. It is that someone records encrypted traffic today, stores it cheaply, and waits for the maths to get affordable. Everything you move now under classical key exchange has a shelf life measured against that future date, not against what is possible this morning.

Which turns it into an ordinary engineering question, and that is where we prefer it. The question is not whether quantum computing is real yet. It is how long each record has to stay private. A queue-jump token for a two-day event does not care. A membership database, a patient record, a tenancy agreement, a payroll file, the access roster for a building: those carry confidentiality lifetimes measured in a decade, and a decade out is well inside the window everybody is now planning against.

The dates are already published

NIST's transition roadmap deprecates RSA-2048 and ECC P-256 from 2030, and disallows them from 2035 (NIST IR 8547, 2024). That is a schedule, not a forecast. Procurement teams will be quoting it in tender documents long before 2030 arrives, because that is what procurement teams do with a published date. If you sell software into the public sector or anywhere regulated, this turns up as a line on a form, and the answer needs to be better than "we use TLS".

"

The clock is not set by when quantum computers start working. It is set by how long your data has to stay secret.

Most of this is unglamorous, which is the point

The transport layer is largely handled already. Hybrid key exchange pairs a classical handshake with a lattice-based one, so the connection holds as long as either half survives. Adoption moved faster than most standards do: post-quantum encrypted traffic across Cloudflare went from 29 per cent of human web requests in January 2025 to 52 per cent by early December (Cloudflare Radar, 2025). For most sites that arrived as a configuration change somebody else made, which is the best kind of security upgrade.

The work that is left is the awkward middle, and it does not benefit from panic. What we would do on a system with a long data life:

• 01Write down where the long-lived secrets actually travel. Not every endpoint, only the paths carrying data with a confidentiality life over five years.
• 02Check what your edge, CDN and managed database negotiate today. On a modern stack you may already be hybrid and simply not know it.
• 03Go after the parts nobody looks at: VPN tunnels, device provisioning, signed firmware, long-lived API keys, any certificate that outlives the contract it was issued under.
• 04Design for agility rather than a single migration. The algorithm you choose this year wants to be a swappable component, not a constant compiled into a box screwed to a wall.
• 05Put a date in the roadmap. 2030 is four years away, which is shorter than the refresh cycle on most hardware we install.

The bit that stuck with us

A consumer phone announced this month at 899 dollars ships quantum-safe secure boot and seven years of operating system updates (Google, 2026). Google has priced a decryption horizon into the support window of a handset it expects to sell in volume. Hardware makers do not add cost to a bill of materials for a threat they privately consider theoretical.

We build things that sit in buildings for years. An interactive install, an operational system, a booking platform, a kiosk on a retail floor. The hardware turns over on a slow cycle and the data outlives every bit of it. If a phone is being specified against 2033, the system you commission this autumn should be held to the same line.