Empty Attestations: OT Lacks the Tools for Cryptographic Readiness

**Executive summary:** The report warns that nation-state actors such as Volt Typhoon have maintained long-term access inside US and Canadian OT environments, enabling collection of encrypted traffic and possibly cryptographic keys or firmware signing keys; this creates a harvest-now-decrypt-later and trust-now-forge-later risk for critical infrastructure, while current regulatory attestation frameworks and tooling are ill-suited to OT constraints and may produce false assurance instead of real security.