Here are some median times from the eBATS benchmark page for a 2013 Intel Xeon E3-1275 V3 3500MHz (http://bench.cr.yp.to/web-impl/amd64-titan0-crypto_sign.html

Here are some median times from the eBATS benchmark page for a 2013 Intel Xeon E3-1275 V3 3500MHz (http://bench.cr.yp.to/web-impl/amd64-titan0-crypto_sign.html http://bench.cr.yp.to/web-impl/amd64-titan0-crypto_sign.html) Cycles to generate a key pair: ed448goldilocks: 176924 ecdonaldp256: 290628 ecdonaldp384: 2202380 Cycles to sign 59 bytes: ed448goldilocks: 185056 ecdonaldp256: 381696 ecdonaldp384: 2367856 Cycles to verify 59 bytes: ed448goldilocks: 583900 ecdonaldp256: 913848 ecdonaldp384: 2741028 (ecdonaldp is ECDSA signatures with NIST P-256/384. The implementation used is OpenSSL, though I don't know which version) AFAIK no elliptic curve size is quantum secure, so I guess the goal is just to require slightly more qubits for an attack.