Hybrid post-quantum signing

QKnot

Sign bytes so the post-quantum half cannot be deleted. The audit that made it necessary: zero PQ signatures in 60,000 artefacts across HuggingFace, npm, and PyPI.

60k artefacts sampled

0 post-quantum signatures

1272 tests passing

pip install qknot
qknot sign ./dist/myapp-1.0.0.tar.gz --out myapp.bundle.json --context myapp-release
qknot verify ./dist/myapp-1.0.0.tar.gz --bundle myapp.bundle.json --context myapp-release

Run the Colab PyPI DOI