TORONTO, Nov. 13, 2026 — The Sovereign Tech Agency is investing more than €1 million in the development of a Merkle Tree Certificate Authority at Let's Encrypt, funding work through the end of 2027. Let's Encrypt calls it the largest single investment in post-quantum readiness at the certificate authority to date, and says it will help pave the path for free post-quantum Merkle Tree Certificates for people globally.

The investment, announced November 5, will support the Internet Security Research Group (ISRG) as it researches, develops and deploys Merkle Tree Certificates across its certificate authority infrastructure. Through 2027 the work includes contributing to standardisation of Merkle Tree Certificate Authorities at the Internet Engineering Task Force (IETF), moving the Merkle Tree Certificate Authority from initial standardisation and staging tests to a fully reliable, compliant production launch, and documenting and rolling out the new certificates globally. ISRG aims for a production-ready service in 2027, with the final launch also depending on browsers, which are still defining their requirements for post-quantum certificate authorities.

Merkle Tree Certificates are a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. Replacing today's certificate signatures with post-quantum equivalents would push a single TLS handshake well past 10 kilobytes, slowing connections and causing some to fail. Merkle Tree Certificates keep the handshake small by covering a whole batch of certificates with one signature; the Sovereign Tech Agency expects the authentication data to stay under 1,000 bytes per connection, smaller than today.

The scale of what is changing is hard to overstate. Let's Encrypt frequently issues ten million certificates per day, and as of October 2026 W3Techs reports that 64.3 percent of all websites use certificates from Let's Encrypt. When the world's largest certificate authority changes what it issues, every enterprise that depends on TLS has to know exactly what it holds.

"Post-quantum readiness starts with inventory, not with buying new cryptography," said Sarah Reid of Securetron. "A certificate authority can change its format on a published timetable, but an enterprise that cannot list every certificate it owns, where each one lives, and when it expires will discover the change the hard way, one outage at a time. The organisations that will move smoothly to post-quantum certificates are the ones that already know their estate today."

Securetron's PKI Trust Manager gives enterprises that inventory. It continuously discovers certificates, expiring assets and vulnerabilities across the enterprise, automates issuance, renewal and monitoring for the entire certificate lifecycle, and provides a single pane of glass across ADCS, MSCA, Let's Encrypt, DigiCert, ACME and more, with full audit trails for every action. Its built-in RFC 8555 ACME server with EAB, plus SCEP and EST enrolment, means certbot, acme.sh, win-acme and network devices all enrol automatically, and certificate expiry alerting with configurable lead times eliminates outages from certificates that quietly lapse.

Boltron-AI, Securetron's AI module for PKI Trust Manager, adds an intelligent operational layer: it discovers certificates, apps and PKI assets, understands their context, plans an appropriate workflow, and can execute approved runbooks where supported, then validates the result and continues monitoring. For teams facing a format change from a major certificate authority, that means onboarding applications to managed PKI with a generated runbook instead of a manual audit.

PKI Trust Manager is available as a self-hosted Community Edition, free for up to 500 certificates, and as PKI Trust Cloud, a fully managed certificate lifecycle service with free signup. Both give teams the discovery and lifecycle automation they need to be ready when certificate authorities change what they issue, whether the next change is a new root, a shorter lifetime, or a post-quantum format.

About Securetron: Securetron builds PKI Trust Manager, enterprise certificate lifecycle management software, and AI-FW, a self-hosted AI firewall and governance gateway for AI agents and LLM backends. Securetron is based in Toronto, Canada. Learn more at https://securetron.net.

Press contact: Sarah Reid, Securetron, 1 Yonge St, Toronto, ON M5E 1E6, Canada, +1 (438) 927-8036, [email protected]