draft-ietf-lamps-pq-composite-sigs, the draft specification for composite signatures, is in the final stages of standardization at the IETF. A composite signature combines ML-DSA with a traditional signature algorithm such as RSA or ECDSA. The two are presented as a single public key, a single signature, and a single algorithm identifier. A verifier accepts the composite only if both component signatures verify.

The benefit to this approach is clear: if one component breaks, the other still provides security. But composite signatures are not a drop-in upgrade into existing infrastructure, and they are not a way to keep legacy clients working. This post covers the benefit, dispels a few misconceptions, and outlines the trade-offs, which are significant.