Notes from a team
shipping the migration.
Post-quantum cryptography, TLS migration deadlines and AI governance, written while building the gateway, not after. No vendor abstractions, no roadmap slides.
Evaluating Tamper-Evident AI Gateways
EU AI Act Article 12 record-keeping has applied to Annex III high-risk systems since August 2, 2026, and most AI audit trails are still ordinary database rows. Seven vendor-neutral questions that separate evidence from logs: offline verification, open verifiers, signed records, content binding, and evidence that survives the vendor.
Read the postThe Evidence Layer Costs Three Milliseconds
We benchmarked the evidence-bearing hot path: TLS, key auth, PHI scan, quotas, routing, and an Ed25519-signed audit record on every call. The first run found a hard ceiling in our own auth; the fix took an afternoon. Full numbers and methodology.
Read the postWhat EO 14412 Actually Requires of Your Crypto Stack
Executive Order 14412 starts hard clocks: PQC migration leads in 30 days, OMB guidance in 90, CBOM minimum elements in 270, and a proposed FAR rule putting federal contractors on a 2030 deadline. A practitioner's read of what it requires.
Read the postWhat the 2030 NIST PQC Deadline Actually Means for Your TLS Stack
NIST IR 8547 proposes deprecating RSA, ECDH, ECDSA and Ed25519 by 2030 and disallowing them by 2035. The concrete deadlines, the five layers a real migration touches, and a quarter-by-quarter plan.
Read the postBuilding a Post-Quantum TLS Gateway in Rust
A technical deep-dive: X25519MLKEM768 hybrid key exchange with quinn 0.11, rustls 0.23 and aws-lc-rs. The four-policy crypto matrix, real code excerpts, and what the handshake actually costs.
Read the postSizing your own migration?
The gateway that these posts describe is live and self-serve. Two DNS records to put hybrid post-quantum TLS in front of what you already run.