A reproducible, whole-ledger measure of how prepared Xahau accounts are to move authority off the one key that can never be rotated — the master key. This is readiness, not alarm.
Hardening doesn't need a protocol change. Two Xahau Hooks, each PROVEN for all inputs by symbolic execution + a counterexample search, move the risk off the master key today:
A non-custodial key-rotation toolkit builds the unsigned transactions to do this safely — never touching a key. A guided Rotation Wizard (a Xaman xApp) is in active development.
What this measures: CONFIG (can an account retire its master key?) via ledger_data over the whole account set — these are network figures, not a sample. “No rotation path” = master key active and no regular key, so the account can only ever sign with its unrotatable master key.
What it does NOT measure: whether a given account has already exposed a key (that's a per-account check). Signer-list multisig isn't counted here, so “hardened” is a slight under-count.
Honesty: Q-Day is a 2030s estimate, contested — this is a hardening score, not a safety alarm. The snapshot is a large but possibly partial scan (see scanned); a BASELINE account is normal, not unsafe.
Sources: NIST PQC (FIPS 203/204/205) · Ripple post-quantum roadmap · xrpl.org / docs.xahau.network · method: xahau-mcp quantum_config_census (open, reproducible).