Post-quantum signatures make classic chains heavy: with ML-DSA-44, the public keys and signatures of a leaf and an intermediate certificate, two SCTs and the handshake signature come to about 14.7 KB, against a few hundred bytes with ECDSA. In the MTC design (Internet-Draft draft-ietf-plants-merkle-tree-certs) the CA appends each certificate to its own transparency log and periodically designates landmark subtrees whose hashes are distributed to browsers ahead of time. A server then presents a certificate with an inclusion proof of a few hundred bytes and no signatures at all; clients without the current landmarks fall back to a standalone, cosigned form.
Google announced in February 2026 that Chrome intends to use MTCs, together with Cloudflare experiments, as its path to quantum-resistant HTTPS authentication and does not plan to add post-quantum X.509 certificates to the current Chrome Root Store. The Chrome Root Program lists a separate, draft policy for a quantum-resistant root program built on MTCs.
Everything here is still in motion: the draft changes between versions, and server and CA software support is experimental. Classic X.509 with post-quantum algorithms (RFC 9881) remains the option for private PKIs.