Vendors integrate post-quantum cryptography into digital identity tools

Post-quantum cryptography is beginning to spread across the digital identity stack, with vendors adding quantum-resistant protection to mobile credentials, PKI, secure hardware and developer platforms. Fobi AI, WISeKey, and Atsign announced updates this week that illustrate how different parts of the digital identity ecosystem are preparing for the transition. In 2024, NIST standardized ML-KEM for shared secrets and ML-DSA and SLH-DSA for digital signatures. But traditional identity systems use public-key cryptography to protect personal and sensitive information and authenticate credentials, devices, and transactions. Information captured today could eventually be decrypted. Separately, vulnerable signing algorithms could enable attackers to forge credentials that appear authentic. At the credential layer, Fobi describes AltID 3.0 as a mobile platform that converts KYC results into credentials that confirm identity, age, authorization, location, and time without disclosing the personal data. WISeKey advances the proposition toward a trust infrastructure by connecting its WISeID platform to the company’s PKI and SEALSQ post-quantum hardware. The proposed Know Your AI model would give an AI agent a verifiable identity that describes its operator, model, permissions, and policies. Atsign moves from a platform positioning to a more defined implementation. It uses X-Wing, combining ML-KEM-768 with X25519 for hybrid key establishment, and ML-DSA-65 for signatures. The public roadmap says the post-quantum primitives have entered its cryptographic library, with SDK and authentication migration staged through November. X-Wing remains an Internet Draft. Meanwhile, security vendor Trellix advises organizations beginning post-quantum migration to identify vulnerable systems, assess supplier readiness, test hybrid cryptography and modernize certificate infrastructure. The announcements reflect a broader industry shift. AuthID has named PQC signature algorithms for its biometric authorization, IOTA has released hybrid signatures for verifiable credentials, and NIST commissioned work to prepare federal identity credentials for post-quantum migration. The transition is expanding across the identity stack, from credentials and PKI to secure hardware, communications and developer tools, but products remain at different stages of maturity. While post-quantum cryptography can protect keys, records and digital signatures, it does not verify whether a document, biometric or AI agent itself can be trusted. Organizations evaluating PQC offerings will increasingly need to distinguish between cryptographic protection and broader identity assurance.