### Hybrid signatures: receipts that stay verifiable after Ed25519 can be forged

- **One suite** ([pq-signatures](extensions/pq-signatures.md) §2): ML-DSA-65 (FIPS 204) beside
  Ed25519, as the composite `id-MLDSA65-Ed25519-SHA512` of
  `draft-ietf-lamps-pq-composite-sigs-19`. Both halves sign the composite's message
  representative of the record's own signed bytes, the ML-DSA half with the suite's label as its
  context, so the Ed25519 half of a hybrid record verifies over no classical record's bytes and
  stripping the post-quantum half leaves nothing that verifies (§4.3). ML-DSA-65 rather than -44
  for the margin of security category 3 over the decades a provenance or delivery record is asked
  to prove something.
- **Where it goes** (§6): a key-log entry may hold an ML-DSA key and a revision a hybrid root,
  committed to before it signs by `BLAKE3("wai:key-set-next\x02" ‖ K ‖ P)`; a group receipt is
  signed over the labelled payload's third version, `moq-jwp:group-sign\x03`, with the key in
  its payload and both signatures in its canonical bytes and link hash, its objects unchanged; a
  claim, and every JSON record signed as `wai:<domain>\x01 ‖ JCS`, carries `pq_suite`, `pq_key`
  and `pq_sig`, read and checked by one shared rule (wired into synthesis's records).
- **Policy and downgrade** (§5, §6.1): a verifier may require hybrid (`hybrid_required`); at
  confirmation, a classical-only item under a hybrid entry is refused (`hybrid_downgrade`), an
  item whose ML-DSA key is not its entry's is refused (`pq_key_mismatch`), and under a pinned
  anchor that requires hybrid only hybrid-signed revisions descend from it and a classical item
  is unconfirmed. A bad post-quantum half is `pq_signature_invalid`.
- **Measured** (§9): a hybrid group receipt is 5552 bytes against 291, the 5261 bytes of the key
  and signature paid once per group and never per object, 42 kbit/s on a receipts track at one
  group a second; hybrid verification takes 114–128 µs against Ed25519's 34–35 µs.
- **Checked**: the ML-DSA-65 implementation against FIPS 204's ACVP vectors (keyGen, deterministic
  sigGen and sigVer, vendored in `pq-conformance/acvp/` and pinned by SHA-256) and the composite
  against the draft's own vector, before anything else; a corpus of 46 cases,
  `pq-conformance/vectors.json` (`wai_pq_vectors`), and its second implementation,
  `pq_verify.py`, which verifies ML-DSA from FIPS 204's text in pure Python. Classical publishers'
  bytes and every existing corpus are unchanged; the reference reads the hybrid forms under the
  feature `pq_signatures`, whose one new dependency is a pure-Rust ML-DSA implementation.

