Post-quantum signing on AWS, Part 1: Building a software supply chain with ML-DSA

AWS published the first of a two-part series showing how to build a post-quantum software supply chain signing architecture using ML-DSA on AWS KMS, AWS Private CA, and IAM Roles Anywhere. The article provides a complete CLI workflow from root CA, subordinate CA, and code signing keys to CI/CD artifact and SBOM signing and deployment verification, covering five parts: key management, PKI, workload identity, artifact signing, and SBOM integrity attestation. It notes that ML-DSA-65 signatures are 3,309 bytes, while ECDSA P-256 is 64 bytes; CNSA 2.0 requires software and firmware signing to use post-quantum algorithms exclusively by 2030, and the EU CRA takes full effect in December 2027. AWS says that as of October 2026, this is the first end-to-end post-quantum signing guide covering the software supply chain from a cloud provider.