Home of Quantum Nexum — post-quantum trust infrastructure: a certificate-authority program, a software stack, and an engineering resource built for the real world.
We build certificate-authority infrastructure, cryptographic tooling, and security software — with an emphasis on real-world deployment and the migration to post-quantum cryptography. Background spans enterprise CA management and Federal PKI operations, including Federal Bridge cross-certification.
Our flagship is Quantum Nexum. Alongside it we ship open tooling for PKI operators and developers, and we're building HomePKI — a private certificate authority for the home network (currently in private beta).
Post-quantum cryptography is no longer theoretical — NIST finalized ML-DSA, ML-KEM, and SLH-DSA (FIPS 203/204/205) in 2024. Most organizations aren't ready. Quantum Nexum is post-quantum trust infrastructure built to close that gap — redesigned and relaunched June 2026.
-8957e5?labelColor=0E1114){kind=icon}
Platform status — what's live and what's in flight
- PKI — a 22-CA ML-DSA hierarchy (ML-DSA-87 root; ML-DSA-65 policy + issuing across seven policy branches), currently being rebuilt. The landing at pki.quantumnexum.com is live; AIA, CRL, and OCSP publication return as the new chain lands. Design: /pki/.
- ACME — an RFC 8555 directory at acme.quantumnexum.com, issuing post-quantum certs against the QN trust anchor. Landing live; the directory opens once the PKI rebuild lands. Details: /acme/.
- Forge — hands-on PQ tooling, live and growing: keygen, signatures, algorithm compare, OpenSSL 3.5 recipes. At /forge/.
- Vault — reference library, live and growing: FIPS 203/204/205, the IETF LAMPS PQ RFCs, OpenSSL 3.5 LTS, liboqs, and the CNSA 2.0 / NSM-10 timelines. At /vault/.
Platform software (alpha — early builds on request via quantumnexum.com):
- Spork — post-quantum certificate authority written in Rust. ML-DSA + SLH-DSA alongside classical ECDSA/RSA/Ed25519; ACME, EST, and SCEP enrollment; OCSP and CRLs. Single static binary (Linux x86_64), RustCrypto primitives — no OpenSSL dependency. BSL 1.1. Public site: /spork/.
- HomePKI — your own CA for the home network: one static Linux binary, post-quantum ready, no cloud, no account. Issue real TLS certificates for routers, NAS, cameras, and Home Assistant — signed by a CA that belongs to you alone. Private beta.
- Supply-chain hardening across the org — every GitHub Actions workflow in every active repository is now pinned to a commit SHA rather than a floating tag, enforced org-wide by policy
- Portfolio consolidation — tailnumber, parcl, qn-claude-web, and shadowtrap are retired; effort is narrowing onto the PKI tooling and Quantum Nexum
- PKI-Client and PKI-Signing-Service under rework — post-quantum signing moves from an opt-in build feature to first-class support in both
- QN PKI hierarchy rebuild underway — AIA/CRL/OCSP publication and the ACME directory follow it
Open code, with each project's real state on the label. Release, CI, and license badges read straight from the repository, so they never go stale — and anything under rework or retired says so plainly rather than leaving you to find out.
| Project | What it does | Status |
|---|---|---|
| PKI-Client · docs | Pure-Rust PKI CLI — inspect certificates, generate keys, probe TLS, validate FIPS 140-3 / NIST SP 800-57 / Federal Bridge compliance, and build CA hierarchies. No OpenSSL; one static musl binary. --features pqc path to first-class support. Existing releases still install. |
    |
| PKI-Signing-Service · docs | Pure-Rust code-signing engine — Authenticode (PE/CAB/MSI), PKCS#7/CMS, RFC 3161 timestamping, PowerShell SIP, detached CMS. Runs as CLI, REST API, or a standalone TSA server; batch signing and PFX import. --features pq-experimental. Existing releases still install. |
   |
| Project | What it does | Status |
|---|---|---|
| issue-reporter | Drop a feedback button on any web page — reports become GitHub issues. One file, zero dependencies, no backend. Auto-captures console errors, recent API calls, and DOM context; strict CSP and SRI supply-chain pinning. |    |
| project-forge | Autonomous idea-generation engine — scores every idea on feasibility, fundability, and ambition across 19 categories, then human-gates one-click promotion to GitHub issues. FastAPI + SQLite; ~$2–3/mo on Haiku 4.5 (or free via the Claude Code CLI). |   |
| gh-tracker | Self-hosted GitHub analytics dashboard — archives traffic, referrers, people, issues, and self-hosted runner state to SQLite before GitHub's 14-day API wipe. FastAPI backend, React dashboard. |    |
No longer in service. Listed for provenance — and, where the writeup outlived the product, because the thinking is still worth reading. None of these are receiving fixes; don't build on them.
| Project | What it did | Status |
|---|---|---|
| tailnumber | Detached Hash-Signing as a Service (dHSaaS) — send a hash, get back a portable signed proof. ML-DSA and hybrid classical+PQ signatures, HSM-held non-extractable keys, 50-year trust chain, offline verification with nothing but OpenSSL. The design writeup stays public — key rotation, generational CAs, and why rotation alone doesn't keep a decades-old signature verifiable. |    |
| parcl | S/MIME encryption, signing, and certificate management add-in for Microsoft Outlook — LDAP directory lookup, AES-256, RFC 5751/7508 compliant. Releases were pulled; the add-in is not installable. |  |
| qn-claude-web | Self-hosted web UI for the Claude Code CLI — xterm.js terminal, persistent tmux sessions, chat, and multi-agent orchestration from any browser on your network. Pure Python, no build step. |  |
| shadowtrap | Multi-protocol network honeypot — 21 emulated services, honeytokens that fire on access, full payload capture with GeoIP and threat scoring, real-time HTTPS dashboard. | |
Licensing varies by project — each badge above reflects that repository's own
LICENSE. Most tooling is Apache-2.0; project-forge is MIT; tailnumber and shadowtrap are closed-source. gh-tracker isn't licensed for reuse yet, and its badge says so.
We take security seriously across all repositories:
- Branch rulesets — every default branch blocks deletion, force-push, and non-linear history, and carries a commit-signature requirement
- Pinned actions — every workflow across every active repository references its GitHub Actions by commit SHA, not by mutable tag, enforced by org policy
- Allow-listed actions — workflows may only use GitHub-owned, verified, or explicitly approved publishers
- 2FA enforced — for all organization members
- Dependency scanning — Dependabot enabled across repositories
- Code scanning — CodeQL and custom security workflows
- Responsible disclosure — see our Security Policy
Found a vulnerability? Email root@quantumnexum.com or use GitHub's private vulnerability reporting.
We build in the open where we can. Contributions and issues are welcome on any of our public repositories.
- Read our Contributing Guide
- Review our Code of Conduct
- Spot something? Open an issue on the relevant repository above
Web — quantumnexum.com | Email — root@quantumnexum.com