I think some combination of a web-of-trust and symmetric cryptography (or even OTPs for the really scary stuff, like code updates to self-driving cars) will wor

I think some combination of a web-of-trust and symmetric cryptography (or even OTPs for the really scary stuff, like code updates to self-driving cars) will work if we need them to. Take Apple (my dev machine) or DigitalOcean (my server provider. They already have root. If my MBP came with a custom-to-me symmetric key to communicate with Apple I could get a signature from them of the symmetric key that DigitalOcean generated for me. The real issue is that everyone is reactive so these types of things don't get fixed until there's a proof-of-concept attack that works. I remember people talking about how states would propagandize social media platforms in the early 2000s and nobody took them seriously; myself included. Though I never mocked them because I didn't see how they were wrong I just saw no evidence that it was happening so I figured someone else was already on it. Nobody is magically on it. National security podcasts are stressing about quantum computers because they know it's probably going to break PKI. The thing I still don't understand about quantum is that it seems to break entropy once you get enough qubits because it covers too many options at once. I keep meaning to experiment with it to understand it better, but I don't have enough time.