Hmm, that's not the vibe I get. The blog indeed doesn't say it is necessarily the most reasonable theory, but goes in depth towards only one: "I’d like to foc

Hmm, that's not the vibe I get. The blog indeed doesn't say it is necessarily the most reasonable theory, but goes in depth towards only one: "I’d like to focus on what I think is the most intriguing hypotheses in the paper. Namely, that the NSA isn’t worried about quantum computers at all, but rather, that they’ve made a major advance in classical cryptanalysis of the elliptic curve discrete logarithm problem — and panic is the result." As for the viability of practical quantum computers, the original paper says: "If practical quantum computers are at least 15 years away, and possibly much longer, and if it will take many years to develop and test the proposed PQC systems and reach a consensus on standards, then a long time remains when people will be relying on ECC. But the NSA’s PQC announcement makes it clear that improved ECC standards (for example, an updated list of recommended curves) are not on the Agency’s agenda." "However, for such users the NSA statement recommends using an additional layer of AES to provide quantum resistance, without waiting for quantum-safe public-key standards. In any case, the statement is directed at the general public and obviously is going to have a big impact in the private sector. If the NSA had wanted to give advice that was intended only for high-security government users, they would have done so." The latter paragraph seems to contradict your conclusion directly. I read the paper as saying that in the case you describe, it would have been reasonable for the NSA to continue ECC work while fleshing out post QC alternatives. But this did not happen.