Role-Separated Post-Quantum Signatures for L1 Networks: Native DSA v2 (Module Rank Family) with FIPS 204 Anchors

Layer-1 networks approaching post-quantum migration—especially Bitcoin and Ethereum-class chains—face a structural tension on the consensus path. FIPS 204 ML-DSA provides standardized assurance for durable and public-facing operations, yet ML-DSA-65/87 signatures (≈3309/4627 bytes) are costly at vote frequency. Falcon is more compact but uses a hash-and-sign NTRU design less aligned with module-lattice KEM and FHE pipelines. This paper presents a role-separated upgrade of the KLTu signature engine: match cryptographic role and wire cost to message lifetime without weakening lattice hardness on the hot path, while retaining FIPS 204 for regulatory and audit posture. The ephemeral path uses Native DSA v2 (Fiat–Shamir with aborts on , ), sharing the platform KEM ring. Tier M and Tier H yield measured signatures of 1056 and 1377 bytes—both sub-MTU. Pinned estimator costs are ≈ and ≈ (BKZ ), comparable in magnitude to lattice-cost regimes associated with ML-DSA-65/87, and are not NIST category claims. Persistent anchors use FIPS 204 via intent routing, tier-locked pairing (65↔M, 87↔H), boundary re-sign, and optional dual attestation; lossless native↔FIPS transcoding is not claimed. On an Intel Core i5-12400 host, Native-M sign/verify means over are 64.88/49.48 µs (p50: 62.78/49.39 µs); Native-H means are 165.9/113.3 µs. Native-M sign TVLA yields (pass at ); K–S and mutual-information results are reported alongside, with negligible noise-level MI. Multi-thread throughput and keygen capacity are reported for validator-scale planning..