I don't necessarily think that this is coming any time soon, but factoring a 5-bit integer is fundamentally different from factoring a 200-bit integer, which is

I don't necessarily think that this is coming any time soon, but factoring a 5-bit integer is fundamentally different from factoring a 200-bit integer, which is why I said we probably need a breakthrough in quantum error correction or other methods such that we can actually entangle hundreds of qubits for long enough to perform meaningful computation. I'm not convinced that we've made meaningful progress on this front in the past 20+ years since IBM first used Shor's algorithm to factor 15 back in 2001. (In 2012, they factored 21. In 2019, they failed to factor 35 due to accumulation of errors.) If you're willing to accept the premise that quantum computers will exist that can break RSA-4096, then those same quantum computers can break elliptic curve crypto based on P256 or P384 or P521. If you're not willing to accept that premise, then what's the point of doubling your key length? Wasting CPU cycles?