I expected this to include a discussion on forward secrecy [1], but it doesn’t seem to. (I searched the page for “forward” but got no hit.) A reasonable tradeo

I expected this to include a discussion on forward secrecy [1], but it doesn’t seem to. (I searched the page for “forward” but got no hit.) A reasonable tradeoff at the current time may be to keep primary keys / certificates classical, and make session key exchange quantum resistant [2]. That would thwart any “harvest now, decrypt later” adversary. It wouldn’t protect against a man in the middle with a big quantum computer, but that’s not a very realistic threat for the foreseeable future. Don’t know how much it will bring down the handshake size though. 1. https://en.m.wikipedia.org/wiki/Forward_secrecy https://en.m.wikipedia.org/wiki/Forward_secrecy 2. https://en.m.wikipedia.org/wiki/Post-Quantum_Extended_Diffie-Hellman https://en.m.wikipedia.org/wiki/Post-Quantum_Extended_Diffie...