Findings
Each finding is numbered in the order it was established, dated, and attached to the chapter that carries its transcript. These are the results that were unexpected, or that corrected an earlier statement — the ones a practitioner is most likely to be searching for at two in the morning.
What the AWS edge will and will not carry: NLB passthrough, ALB hybrid policies, and ACM's refusal
A Network Load Balancer carried fully post-quantum TLS to a fleet without looking at it; the Application Load Balancer turned out to offer hybrid key exchange already; and AWS Certificate Manager would not accept an ML-DSA certificate at all.
Binding a free certificate authority to a root in hardware it cannot reach
Seventy minutes, scripted in advance and corrected twice, that placed the root of a post-quantum PKI in an HSM the CA software has no way to talk to. The chain verified anyway.
The library was never the variable: four layers between OpenSSL 3.5 and a post-quantum database session
PostgreSQL could not name the hybrid group, the distribution withheld the signature algorithms, the authentication protocol failed closed, and the CA's runtime chose nothing.
The CA survived a reboot on a volume nobody declared — and did not come back up
A dry-run certificate authority, a host reboot, and two behaviors that were both correct and neither of which was a procedure.
One administrator command, and Windows negotiated post-quantum key exchange with the Internet
Schannel ships the hybrid ML-KEM group disabled. Enabling it took one elevated PowerShell line and no reboot; the far end, a production endpoint, reported X25519MLKEM768 from its side.
Java rejects any certificate chain with an ML-DSA signature in it — even under a classical leaf
A fully classical P-256 server certificate was undeployable on Tomcat because the CA that issued it signed with ML-DSA-65. The constraint is on the issuer, not the endpoint, and it reshapes a migration plan.
Eighty-seven findings are recorded. They are being published here in order of usefulness, not number; the full record ships with the book.