> "We are making this change now (i.e. ahead of cryptographically-relevant quantum computers) to prevent 'capture now, decrypt later' attacks where an adversary

> "We are making this change now (i.e. ahead of cryptographically-relevant quantum computers) to prevent 'capture now, decrypt later' attacks where an adversary who can record and store SSH session ciphertext would be able to decrypt it once a sufficiently advanced quantum computer is available." This is something I've been thinking about. I have a feeling the NSA will have a useful quantum computer long before anyone else believes that anyone has one.