I feel like 1) that is the key quote, 2) it's true, 3) it's also setting the bar too high for current efforts. The first go at a post-quantum public-key crypto

I feel like 1) that is the key quote, 2) it's true, 3) it's also setting the bar too high for current efforts. The first go at a post-quantum public-key crypto standard may in effect be (a public-key analog of) the DES that'll need be replaced with an AES someday. But provided we can get something that isn't a step backwards in classical security (so, well-studied problem) and doesn't fall to Shor's algorithm or any other thing we can find in a few years, that's way ahead of where we are now. We may be feeling around in the dark because we don't know much about quantum computing, but we may also have to do that if we want reasonable security when the first big quantum computers show up.