I was definitely thinking, "why not use Curve25519 for a 256-bit key if fitting the response into one packet is so important?" It seems there's some worry abou

I was definitely thinking, "why not use Curve25519 for a 256-bit key if fitting the response into one packet is so important?" It seems there's some worry about quantum computers being able to break ECC with less qubits than RSA on account of there being less actual bits. But to me, it seems like if quantum computers come about that start breaking things, RSA is going to need to be replaced as well. So now's probably not the time to be too paranoid about something we don't yet know will ever even happen. At least, not until we have something we know will be resilient to the new quantum attacks.