A few notes on Post-Quantum Certificates:
- Yes, Merkle-Tree Certificates (MTCs) are smaller than ML-DSA certs, but still pretty large
- MTCs come in two flavors: standalone and landmark-relative; servers will need to support both
- clients need to update landmarks frequently; how will non-browsers handle that?
- web-PKI (MTCs) and private PKI (ML-DSA) are diverging
Things are getting more complex...