I should also comment that even someone who believes QC's will never be a thread should be enthusiastic about this change: Now an attacker who has logged SSH

I should also comment that even someone who believes QC's will never be a thread should be enthusiastic about this change: Now an attacker who has logged SSH sessions will need to break both the Ed25519 and Streamlined NTRU prime. Even if you believe we'll never see a QC large enough to break ed25519 you can't deny that we might someday find a classical way to break ed25519. For authentication keys we can rotate them out when ed25519 looks at risk, but logged data is forever. Protecting against that by using two very different asymmetric schemes seems well justified esp when the cost is likely to be completely invisible to the user. Reasonable people could have a debate about how far to go-- e.g. I think low volume applications like email encryption should be using ed448+McEliece but I seem to be alone there-- but just having N+1 security for the key exchange underlying assumption seems very defensible to me.