On Oct. 1, the National Security Agency sharpened America’s post-quantum deadline. Beginning in 2027, new commercial National Security Systems must be capable of supporting quantum-resistant algorithms, and legacy systems that cannot do so are to be phased out by 2030.

That deadline focuses attention on migration. But even a fully migrated system can carry a stale green check mark. The cryptography can be current, while the evidence used to approve that configuration is not.