Building a post-quantum certificate authority with Merkle Tree Certificates

This post details the architecture and implementation of Merkle Tree Certificates (MTCs) for post-quantum cryptography in the context of Cloudflare becoming a Certificate Authority (CA). It explains the scaling challenges of post-quantum signatures in the current Certificate Transparency (CT) ecosystem and how MTCs address this by batching certificates into a Merkle tree, allowing for compact inclusion proofs and efficient verification. The post outlines the roles of CAs and Mirroring Cosigners in the MTC ecosystem, the standalone and landmark-relative forms of MTCs, and the issuance workflow using ACME. It also discusses Cloudflare's plans to fork Boulder for ACME support and its commitment to providing standard MTC issuance at no cost.