Note that some algorithms (Rivest's time lock puzzles[0] come to mind) don't have obvious equivalents for elliptic curves, so it's still important to be able to

Note that some algorithms (Rivest's time lock puzzles[0] come to mind) don't have obvious equivalents for elliptic curves, so it's still important to be able to generate good RSA keys. [0]https://people.csail.mit.edu/rivest/pubs/Riv19f.pdf https://people.csail.mit.edu/rivest/pubs/Riv19f.pdf Essentially, you use some high iteration count of the Blum Blum Shub pseudorandom number generator to encrypt some data. If you know the factorization of your modulus, you can randomly seek very far ahead in the Blum Blum Shub output. Others that don't know the factorization will need to sequentially generate random numbers from the known starting seed for several years to find the pseudorandom output needed to decrypt the message. Blum Blum Shub parallelizes very very poorly if the modulus factorization isn't known. Very well financed adversaries can use gallium arsenide/strained silicon on saphire ASICs, etc. to get constant factor speed-ups over a regular desktop machine, but one can make good educated upper limit guesses on these advantages.