[Feature Request]: Post-Quantum Cryptography: Track Let's Encrypt MTC support + ML-DSA certificate requests

What problem does this feature solve or what does it enhance?

France's ANSSI will stop certifying security products without post-quantum cryptography starting in 2027 - the first hard regulatory deadline of its kind globally. Additional mandates: US NSA CNSA 2.0 (2027), NIST IR 8547 (deprecation by 2030, disallowed by 2035), EU critical infrastructure (2030).

Context

Let's Encrypt announced Merkle Tree Certificates (MTCs) on June 3, 2026 - their path to post-quantum authentication at web scale. The announcement explicitly states:

"some of the changes coming will require client-side support"

and recommends ACME client maintainers track the IETF PLANTS working group.

Certbot currently has zero PQC tracking, documentation, or code changes in response to this announcement.

What's Now Possible

pyca/cryptography v49.0.0 (released June 12, 2026) added ML-DSA X.509 certificate signing and CSR generation. Certbot requires cryptography >= 43.0.0. The dependency chain is now unblocked.

Proposed Solution

Proposed Roadmap

Phase 1: ML-DSA Key Type (Near-term)

• Add --key-type ml-dsa-44, --key-type ml-dsa-65, --key-type ml-dsa-87 (alongside existing rsa and ecdsa)
• Generate ML-DSA CSRs using pyca/cryptography 49+
• This enables certbot users to prepare PQC CSRs even before CAs accept them

Phase 2: MTC Support (Medium-term)

• Track IETF PLANTS working group specifications for Merkle Tree Certificate ACME extensions
• Implement MTC request/install flows per draft-ietf-plants-merkle-tree-certs
• Target Let's Encrypt's staging environment (late 2026) and production (2027)

Phase 3: Dependency Bump

• Bump cryptography minimum to >= 49.0.0 to unlock ML-DSA primitives

Timeline

Milestone	Date
pyca/cryptography 49 shipped ML-DSA X.509	June 12, 2026
Let's Encrypt MTC staging	Late 2026
France ANSSI mandate	2027
Let's Encrypt MTC production	2027
NIST classical crypto deprecation	2030

Alternatives Considered

References

• A Post-Quantum Future for Let's Encrypt
• IETF PLANTS Working Group
• draft-ietf-plants-merkle-tree-certs
• pyca/cryptography 49.0.0 Changelog (ML-DSA X.509)
• France ANSSI 2027 Mandate
• NIST FIPS 204 (ML-DSA)