Nobody is arguing switching production systems to the new algorithms anytime remotely soon. The closest I've heard of is Google adding a mixed ECC/post-quantum

Nobody is arguing switching production systems to the new algorithms anytime remotely soon. The closest I've heard of is Google adding a mixed ECC/post-quantum crypto algorithm in Chrome's Canary (bleeding edge channel)[1], but the whole point of the construction is that you need to break both (or break XOR, I guess :P). As far as I can tell, we're still in the early "is this algorithm any good" stage as opposed to the "did we implement the algorithm right" stage. More generally, its pretty easy to turn any security recommendation by the NSA into a plot (they recommend SHA-3 cause they broke it and not SHA-2!). I'd save my suspicion for cases where they (a) give advice contrary to independent experts or (b) give strangely specific guidance with no apparent rationale. [1]: https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html https://security.googleblog.com/2016/07/experimenting-with-p...