@djb When we will have quantum computers that can break ECC and RSA in milliseconds at scale we will also have a better view of which PQC holds up whether against conventional computers (+AI) or/and quantum computers. The future will probably be some hybrid computer.