Hybrid signatures

A hybrid signature signs the same message with two schemes at once, one classical (such as ECDSA or Ed25519) and one post-quantum (such as ML-DSA), so the signature remains valid if either scheme survives. Hybrids exist for the transition decades: classical algorithms carry today's verifier compatibility while the post-quantum layer protects the artifact's long-term evidentiary value.

The subtle engineering requirement is canonicalization: both signatures must cover byte-identical input, or the layers can diverge exactly when the stronger one is needed.

The composition has to be decided explicitly rather than left implicit. Whether a verifier must check both signatures or may accept either, and what it should do when one verifies and the other does not, is a policy that belongs in the format and in the documentation, because a verifier written on a different assumption will accept artifacts the signer intended to be rejected.

Canonicalization is the requirement most likely to be discovered late. Both signatures must cover byte-identical input, and a document that is stored, re-indexed or round-tripped through a database will not preserve key order on its own, which is what JCS canonicalization exists to fix. Where the protocol can sign raw bytes instead of a structure, that is the simpler design.

The size cost is the sum of both layers plus the framing, which is the practical reason hybrids are described as transitional. They exist to carry compatibility and long-term assurance at the same time during a migration, not as a permanent target state, and the exit condition is verifier support for the post-quantum scheme alone.

Distinguishing the two roles also keeps the claim honest: the classical layer is what today's verifiers check, and the ML-DSA layer is what protects the artifact's value later.

Where a verifier population is known and controlled, the exit can be quick; where it is the open internet, the transitional state lasts as long as the slowest verifier.