The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere

The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg