Post-Quantum OpenPGP Arrives: RFC 9980, the GnuPG Split, and the Signature Gap

Table of ContentsMy AnalysisA format whose ciphertext outlives everything elseWhat post-quantum OpenPGP gets rightOne carve-out carries the politicsTwo PGPs, one installed baseSignatures are where OpenPGP still runs the worldWhat to do with a PGP estate

June 30, 2026 — In June 2026, the Internet Engineering Task Force (IETF) published RFC 9980, a Proposed Standard titled “Post-Quantum Cryptography in OpenPGP.” The document defines quantum-resistant public-key encryption and digital signatures for the OpenPGP message format, extending RFC 9580, the 2024 revision of the protocol. It is the post-quantum OpenPGP extension the working group has been building since mid-2022, and it draws entirely on algorithms from NIST’s post-quantum standardization: ML-KEM (formerly CRYSTALS-Kyber) for encryption, ML-DSA (formerly CRYSTALS-Dilithium) for signatures, and SLH-DSA (formerly SPHINCS+) as a standalone signature option.

The specification was written by Stavros Kousidis of Germany’s Federal Office for Information Security (BSI), Johannes Roth and Falko Strenzke of the German cryptography firm MTG AG, and Aron Wussler of Proton AG. It began as an individual submission in 2022, weeks after NIST announced its algorithm selections, and passed through 17 working-group revisions before the IESG approved it for publication.

For organizations that still run OpenPGP anywhere in their stack—and far more do than realize it, in encrypted backups, batch file transfers, secrets tooling, and the signature checks behind every Linux package install—the reference design for quantum-resistant OpenPGP now exists as a published standard. Whether the tools in their pipelines implement that standard, or a rival one, is now the operative question.

RFC 9980 defines two composite encryption algorithms: ML-KEM-768 combined with X25519, which every implementation must support, and ML-KEM-1024 combined with X448, which implementations should support. On the signature side, ML-DSA-65 com…