Mentioned in This Article
1. A partnership built around a question, not a price cut
Project Eleven, a post-quantum security company, announced on October 20 that Relm Insurance has become a development partner for Strongpoint, the custody product it aims at institutional clients. The two firms will study whether the measures an institution takes against future quantum computers should be weighed when an insurer underwrites its digital assets. No premium, discount, policy or timeline was announced.
The companies described the arrangement as the first partnership to explore post-quantum security as a factor in pricing digital asset insurance. They were careful to present the work as exploratory. Whether any of it reaches underwriting or premiums depends on further evaluation and on Relm's own underwriting process, which means a customer cannot yet expect a lower bill simply because it adopts quantum-resistant tools.
That restraint matters for anyone reading the announcement as a pricing event. What exists today is an agreement to examine a question: if an institution can show that its keys, signing procedures and vendor dependencies are prepared for a post-quantum world, does that evidence change how an insurer sees the risk? The answer is not yet known, and neither company claimed otherwise.
2. What will the two companies examine?
The partners plan to look at four broad areas of an institution's setup. The first is how exposed its cryptographic keys are. The second is how it signs and approves transactions. The third is how prepared it is to migrate to post-quantum cryptography, the family of algorithms designed to withstand attacks from quantum machines. The fourth is which outside vendors it depends on, since a weakness in a supplier can undermine otherwise sound controls.
Relm will also feed back into the design of Strongpoint itself. Its input is expected to cover security controls, auditability and the kind of evidence a client could hand to an insurer to demonstrate post-quantum readiness. In practical terms, that last item is the heart of the exercise. An underwriter can only reward a safeguard it is able to verify, so a product that produces clear, checkable records may matter as much as the cryptography underneath it.
This is a familiar pattern in insurance. Coverage for fire, cyber incidents and theft has long been shaped by what a policyholder can document: sprinkler systems, multi-factor authentication, audited procedures. The Relm and Project Eleven work asks whether quantum preparedness could eventually join that list for holders of digital assets.
3. What the executives said
Joseph Ziolkowski, founder and chief executive of Relm, framed quantum computing as a clear emerging threat that should inform how risk is assessed now rather than after the fact. He said the collaboration will look at how institutions identify their exposure, show that their controls are effective and prepare for the transition to post-quantum systems.
Alex Pruden, chief executive and co-founder of Project Eleven, spoke about the deal on Monday in a podcast interview. He said he was excited about the Strongpoint partnership and argued that proactive steps, including crypto agility and post-quantum security, could bring costs down. Among those costs he counted insurance premiums, which he suggested might otherwise rise to cover both known and unknown risks.
Pruden also pointed to the timing of the shift. In his words, the open question is whether the transition happens on the institution's own schedule or under pressure. That distinction captures the commercial pitch: an organization that moves early can plan and test its migration, while one that waits may be forced to act quickly once a threat becomes concrete.
4. Who is Relm Insurance?
Relm is a specialty insurer domiciled in Bermuda and founded in 2019. It writes coverage for companies in digital assets, artificial intelligence and other emerging sectors. Insurers working in these areas face a recurring difficulty: loss histories are short, technologies change quickly, and the threats that matter most may not have occurred yet.
Quantum computing fits that description closely. No machine capable of breaking widely used public-key cryptography has been shown to exist, so there is no claims record to analyze. Underwriters therefore have to reason from scenarios and from the quality of an institution's preparation. Studying that preparation alongside a custody developer gives Relm a way to build the framework before a loss forces the issue.
5. Why custody sits at the center of the quantum debate
The concern is straightforward in outline. A public key is already visible on a blockchain, and a sufficiently large quantum computer could in theory work backward from it to derive the private key that controls the funds. Anyone holding that private key could move the assets. For custodians, who safeguard large pools of digital assets on behalf of clients, the potential consequences of such an attack are concentrated in a small number of keys.
Project Eleven launched Strongpoint on October 7, with the Zcash Foundation as its first development partner. The product runs classical and post-quantum signatures side by side. It also keeps an institution's approval rules and audit trail separate from the cryptography itself, so the signing algorithm can be swapped out without rebuilding those controls.
That separation is the feature most relevant to insurance. If governance rules and records stay constant while the underlying algorithm changes, an institution can upgrade its defenses without discarding the evidence trail an underwriter would want to inspect. It also supports the idea of cryptographic agility, the ability to change algorithms as standards and threats evolve.
6. How does a quantum computer threaten digital asset keys?
Most blockchains rely on public-key cryptography, in which a private key is used to produce a signature and a matching public key lets anyone verify it. The security of the scheme rests on a mathematical problem that is practically impossible for today's computers to reverse. A sufficiently large quantum computer running specialized algorithms could, in theory, solve that problem far faster, which is why researchers describe quantum machines as a long-term risk to signatures used across the industry.
The word that carries the weight in that description is 'sufficiently'. Current quantum hardware is far from the scale such an attack would require, and no one has put a firm date on when, or whether, that scale will be reached. Security planners nevertheless prefer to prepare early, because migrating the cryptography behind custody, wallets and settlement systems takes years of design, testing and coordination, and because data exposed today could be attacked later.
Post-quantum cryptography refers to algorithms built to resist both classical and quantum attacks. Standards bodies have been working through candidate schemes for years, and vendors have started to ship products that combine old and new signatures. Running the two side by side, as Strongpoint does, is a common transitional approach: it keeps compatibility with existing networks while adding a layer designed for the future.
7. How do insurers price a risk with no claims history?
Underwriting normally leans on loss data. An insurer examines how often a type of event has occurred, how costly it was, and which safeguards separated the policyholders who suffered losses from those who did not. For a threat that has never materialized, that approach is unavailable. Underwriters must instead assess the quality of controls, the concentration of assets, the governance around access, and the speed at which an institution could respond.
Crypto custody already presents some of these challenges. Losses tend to be large and sudden, and they often trace to key management, internal procedures or third-party providers rather than to flaws in the underlying cryptography. That is why the four areas named by the partners, key exposure, transaction signing and approval, migration readiness and vendor reliance, look like a conventional operational risk review adapted to a new threat.
If a framework emerges, it would probably take the form of questions and evidence requirements rather than a single formula. An institution might be asked to show an inventory of where its keys live, how many signatures it can produce under each algorithm, how quickly it could rotate keys, and which suppliers hold any part of the process. Strongpoint's design, which keeps approval rules and audit records apart from the signing algorithm, is intended to make such answers easier to produce.
8. What does cryptographic agility mean for an institution?
Cryptographic agility is the capacity to replace one algorithm with another without redesigning an entire system. Pruden's reference to crypto agility points to this idea. An agile institution treats its signature scheme as a component that can be exchanged, while its policies, approvals and records stay in place. Institutions that hard-wire a single algorithm into every process face a larger and costlier migration when standards change.
For insurers, agility is attractive because it shortens the period in which an asset is exposed. If a weakness in one algorithm becomes known, an agile custodian can move to another quickly, whereas a rigid one may need months of rework. Whether underwriters will actually credit that difference is part of what the new collaboration intends to explore, and the answer will depend on what evidence institutions can supply.
The arrangement also gives a custody developer feedback from a party that will eventually have to rely on its outputs. A product designed with an underwriter's questions in mind may expose more of its logs, controls and test results than one built only for engineers, and that transparency can help both sides regardless of how pricing develops.
9. Wider signs that custodians and regulators are paying attention
The announcement arrives amid growing institutional attention to the issue. Last week, Coinbase, which holds about 5% of all bitcoin, told Bitcoin developers that any quantum-resistant upgrade must work for large custodians. The message was that a protocol change designed without custodians in mind could be difficult or risky for the firms that hold much of the supply.
Earlier this month, Europol urged providers of crypto wallets to begin testing post-quantum upgrades. Taken together, the comments from a major exchange and a law enforcement agency show that the topic has moved from academic discussion toward operational planning, even though no one has announced a date by which quantum machines will threaten current cryptography.
10. What to watch next
No schedule has been given for the findings, and Relm has not said it will change how it prices policies. The first signals to look for are practical ones: whether Relm publishes criteria for what counts as evidence of post-quantum readiness, whether other insurers take up similar questions, and whether further custody clients join Strongpoint as development partners.
For institutions holding digital assets, the immediate takeaway is modest but concrete. Insurers are beginning to ask how quantum risk should be measured, and the documentation an organization can produce about its keys, approvals and vendors may become part of that conversation. Whether it also becomes part of the price is the question the two companies have now agreed to study.