> I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs.

The funny thing is there's, for the foreseeable future (decades), no viable QCs at all expect breaking non-QC cryptography.

And should breaking non-QC cryptography become even remotely possible, the effect is going to be that everything is going to shift, like SSH, to an hybrid solution with two algos: good old non-QC resistant algo and new fancy QC-resistant algo.

So basically QC will have achieved jack shit besides moving everybody to use two algos instead of one.

In 2060 you'll have one device able to use quantum computing to break some messages from 2030, incriminating old senile or long dead politicians, that nobody will give any shit about.

That's the weirdest thing about this whole thing: the only viable QC we hear about is "breaking cryptography" but as soon as that becomes a possibility, we'll all be moving (just like TFA and OpenSSH are showing btw) to QC-resistant algos.

Making QC non-viable.

So... Besides cracking old obsolete message, what the heck can QC be used for?

I mean: what good are those machines going to bring the world, besides cracking old messages nobody cares about and besides making every switch to QC-resistant schemes (like hybrid old+new algos)?