NSA asks that all new hardware can at least be upgraded to full quantum resistance, which is likely to require a quantum-resistant signature for the root of trust, and that organizations commit now to all new acquisitions being capable of quantum resistance, as the step that lets the 2027 acquisition requirement be met. The FAQ's reason: firmware roots of trust are hard to update, so the quantum-resistant root must come first.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.