Identity Is What Survives the Key

We named our company after a research project that failed. The project was mine, and so was the failure.

KeyFlux came from an idea I couldn't put down: keys in constant flux. Rotate a key fast enough, with quantum-safe key establishment underneath, and a stolen key is worthless before anyone can use it. I wanted to try it on government messaging and voice. Not real QKD, no dedicated fibre, no photons. A QKD-inspired rotation model in software, with post-quantum key establishment doing the work the physics would normally do.

I should say up front: I'm not a cryptographer. I'm the person who has to deploy the things cryptographers build and make them work in a real network under real threats. So I don't build these experiments to prove a theorem. I build them to find out where an idea actually belongs. This one taught me something I didn't go looking for: that encryption was never the scarce thing at all.

The test

In mid 2025 I was running technology at a national telco, and we'd just stood up a QKD network test. Real quantum links, real hardware. And it worked. As network infrastructure it was a genuine success. Keys flowed, the links did what the physics promised, and it was impressive to watch.

Quick primer. Quantum key distribution lets two ends of a fibre agree on a shared secret by sending single photons. Measure a photon and you disturb it, so an eavesdropper leaves a trace and the two ends can tell if anyone listened. The appeal is that the security rests on physics, not on a hard maths problem a quantum computer could one day solve. But notice what QKD actually gives you: key agreement, and nothing else. It doesn't tell you who's on the other end. It doesn't sign anything. Hold that thought.

So we had this asset, and I wanted to know something the vendor decks never seemed to say: how far up the stack does the value actually go? What telcos actually sell is quantum-secured links. Keys delivered to the encryptors between two sites, a datacenter interconnect, a quantum VPN. That's a network-layer product, and site-to-site it works. But the flagship story always reaches higher, to secure government comms, and that means pushing those same keys all the way up to the application, where people actually talk. So could the keys climb the stack, or did their value stop at the link? That was the question I went to test.

So that's what I tested. QKD-fed key rotation for messaging and voice, against what governments would really be replacing: modern end-to-end encryption built on the double ratchet.

The wrong layer

Never trust the network for encryption. Not because carriers do it badly (heh ok, can't keep a straight face here), but because you can't verify what they do.

Be fair about what telcos run: IPsec between sites, MACsec on exposed links, optical encryption on long-haul. Plenty of it is well engineered. The problem is structural. Whatever encryption exists was chosen by the operator, ends where the operator decides, and is invisible to you. The moment your traffic crosses into an upstream provider, the question “is this route encrypted?” has no answer you can check. There's a contract, maybe. But hey, contracts don't encrypt anything.

We all learned this in 2013, when it came out that intelligence agencies were tapping the private fibre between Google's own datacenters. Private fibre, plaintext, because everyone assumed private meant safe. Google's answer wasn't to demand better links from carriers. It was to encrypt everything at the application layer and treat every wire as hostile. That's been the right answer ever since. Encryption belongs next to the data, keyed to the session, opaque to every box in between. The network should be a fast, dumb, untrusted pipe.

And QKD, for all the exciting physics, is a network technology. Hold it against that standard for a min.

Remember from above, the whole sales pitch rests on one property: measure a photon and you disturb it, so you can always tell if someone listened. True, and genuinely awesome for the confidentiality of the data. But that same property is the catch. If a photon can't be observed without being disturbed, it can't be copied or amplified either, and that caps the range at around a hundred kilometres of fibre. Go further and you need trusted relay nodes, where the key is decrypted to ordinary plaintext, in a building the operator runs, and re-sent.

This isn't theoretical. The Beijing-to-Shanghai backbone, currently the biggest in the world, runs about two thousand kilometres through roughly thirty-two trusted relays. Think about where your key is. At every one of those sites it sits in plaintext, guarded not by quantum mechanics but by fences, procedures and personnel vetting. The physics holds on each span and evaporates at each node. That's telco link security in a physics costume: your security now rests on thirty-two buildings, and you can verify none of them. And let's be honest, there's no way I'd run a link like this without also encrypting the data at the application layer. Which rather gives the game away.

I've debated this with quantum physicists, and inside their model they're right. Key agreement on a QKD span is information-theoretically secure. I'm happy to be wrong about the physics. But a proof doesn't remove trust, it relocates it: into the devices behaving as modelled, the relay sites staying honest, the operators staying honest. And nobody attacks the crypto anyway. They attack everything around it. Nobody breaks RSA, they steal the key off the endpoint. The physicist is describing a channel. I'm describing a deployment.

Then the numbers finished it off, and this is where being not-a-cryptographer helped, because I just measured it. My prototype couldn't keep up. I blamed the laptop, then did the arithmetic against real deployments and the wall didn't move. Once you account for distance, loss, and the classical traffic sharing the fibre, the usable key rate sits nowhere near what per-session rotation across a fleet needs. Fine between two datacenters. Hopeless for a country's phone calls. The laptop hadn't hidden the problem, it had shown it to me early and for free.

And by then the question had answered itself. Mainstream messaging had already folded post-quantum key establishment into the ratchet. Signal shipped PQXDH in 2023. Apple's PQ3 was rekeying live conversations in production. The interesting half of what I was playing with, fast rotation plus post-quantum key establishment, was already on a few billion phones. They'd kept it at the application layer and swapped the photons for Kyber, the algorithm we now call ML-KEM.

So the idea wasn't wrong so much as half right. It welded two things together: aggressive key rotation with post-quantum key establishment, and quantum-delivered keys as the source. The source was the wrong layer. The rotation was the right instinct. I was right about the direction and wrong about the mechanism, and finding that out by building it is the whole reason I build things.

What the failure was pointing at

Losing that argument forced a better question. If the physics wasn't where the value lived for encryption, what about trust?

Here's what a shared secret can't do. QKD hands two endpoints a secret. So does the double ratchet, the thing that beat my messaging idea. A secret lets two parties talk in confidence, but it can't tell you who's on the other end. And there's no point in unbreakable encryption to someone you haven't verified is the right person. That's not a limit of QKD. It's what a secret is.

Trust is the opposite job. A border officer has to check a credential from an issuer they've never met. A billion phones have to agree one root certificate is genuine. A court has to accept, a decade later, that an audit record is real. None of that runs on a secret. It runs on a signature, which anyone can check without holding anything private. And a signature is maths, not photons. The photons never sign anything.

So if photons don't sign, what does? Post-quantum cryptography. Plain maths a quantum computer can't unpick, running on ordinary computers, sitting exactly where the old maths sat. Not new physics. Just harder sums.

And the risk isn't spread evenly. It comes down to one thing: how long something has to last. A TLS session lasts minutes and gets its protection almost for free as libraries update. A national root lasts fifteen years. Credentials, ten. Audit records have to stand up in a dispute a generation later. The longest-lived signed things in the whole stack are all statements about identity. So the quantum transition isn't really a cryptography problem. It's a trust problem with cryptographic symptoms. The session layer migrates quietly. The trust layer is where the risk pools, because it's where we build things to last.

That's the journey KeyFlux made, in one line. I started with keys, the most ephemeral thing in security, trying to make them too short-lived to steal. The company that came out of it builds for the most durable things: roots, credentials, evidence, the statements that have to outlive the algorithms that signed them. We didn't abandon the founding idea. We just had it backwards. The problem was never making keys vanish fast enough. It was making trust last.

The bridge

There's a trap in the migration. Re-root a PKI or re-issue a nation's credentials, and you have to prove the new key belongs to the same person as the old one. Chain it to the old signature and your quantum-safe credential rests on a classical-strength link, one an attacker can forge the day the old algorithm falls. So the binding has to be made quantum-durable now, while the old signature still means something. Build that bridge before a capable quantum computer exists, or it can never be trusted. Most security degrades gracefully when you're late. This one doesn't, and the clock is public: the EU wants critical infrastructure migrated by 2030, and from 2027 France won't certify products without post-quantum crypto.

How we build for it

This is what KeyFlux builds now. And the point isn't that we use post-quantum signatures, or quantum entropy, or hash-chained evidence, as if collecting clever technology were the goal. It's the opposite. We started from the problems, the ones I spent a career running into, and reached for each tool only where the outcome needed it. Not one technology sprayed across everything. The right one where it earns its place, and nowhere else. That's the whole reason I build things: to understand a problem well enough to know exactly where a tool belongs, and where it doesn't. The problem underneath all of it is simple to say and hard to do: keep trust intact when the algorithms beneath it get replaced.

And because no two countries migrate on the same schedule, cross-border trust means running classical and post-quantum anchors side by side and knowing who trusts what, when. Where a government has quantum infrastructure of its own, we use it for what it's good for: protecting the plumbing, feeding entropy, hardening a link. Never for the statements. Migration isn't an event. It's a decade-long state, and trust infrastructure has to be built for the state.

The invariant

I named a company for keys in flux, then spent it building for the things that don't flux at all. Keys rotate. Algorithms get deprecated. We're living through the end of a cryptographic era right now. What has to survive the crossing is trust: the binding between a person and a claim, still verifiable, still transferable, still meaning something after the maths underneath it has been replaced.

My failed messaging experiment and a national trust root turn out to be the same idea at opposite ends of the clock. One makes the key so short-lived that only the binding matters. The other makes the binding so durable it has to outlive the algorithm that signed it.